Product Affected

Junos Space and JA1500, JA2500 (Junos Space Appliance) with Junos Space 13.3 and earlier releases.
High
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Problem

Junos Space release 14.1R1 addresses multiple vulnerabilities in prior releases with updated third party software components. The following is a list of software upgraded and vulnerabilities resolved:

OpenJDK runtime 1.7.0 update_45 was upgraded to 1.7.0 update_65 which resolves:

CVE CVSS v2 base score Summary
CVE-2014-0460 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) Vulnerability in JNDI.
CVE-2014-0423 5.5 (AV:N/AC:L/Au:S/C:P/I:N/A:P) Vulnerability in Java Beans.
CVE-2014-4264 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) Vulnerability in Java Security.
CVE-2014-0411 4.0 (AV:N/AC:H/Au:N/C:P/I:P/A:N) Vulnerability in JSSE.
CVE-2014-0453 4.0 (AV:N/AC:H/Au:N/C:P/I:P/A:N) Vulnerability in Java Security.
CVE-2014-4244 4.0 (AV:N/AC:H/Au:N/C:P/I:P/A:N) Vulnerability in Java Security.
CVE-2014-4263 4.0 (AV:N/AC:H/Au:N/C:P/I:P/A:N) Vulnerability in Java Security related to Diffie-Hellman key agreement.

OpenSSL CentOS package was upgraded from 0.9.8e-20 to 0.9.8e-27.el5 which resolves:

CVE CVSS v2 base score Summary
CVE-2012-2110 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) Buffer overflow vulnerability.
CVE-2012-2333 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) Integer underflow in OpenSSL.
CVE-2014-0224 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) OpenSSL does not properly restrict processing of ChangeCipherSpec messages aka the "CCS Injection" vulnerability.
CVE-2011-4576 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) The SSL 3.0 implementation in OpenSSL vulnerable to disclosure of sensitive information.
CVE-2011-4619 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) Denial of service (CPU consumption) vulnerability.
CVE-2012-0884 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) OpenSSL vulnerable to Million Message Attack (MMA) adaptive chosen ciphertext attack.
CVE-2013-0166 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) Denial of service (NULL pointer dereference and application crash) vulnerability.
CVE-2011-4109 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P) Double free vulnerability in OpenSSL.
CVE-2013-0169 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N) Plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

Oracle MySQL was upgraded from 5.5.34 to 5.5.36 which resolves:

CVE CVSS v2 base score Summary
CVE-2013-5908 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P) Denial of service vulnerability in MySQL Error handling

Solution

These issues are fixed in Junos Space 14.1R1 and all subsequent releases.



Junos Space Releases are available at http://www.juniper.net/support/downloads/?p=space#sw .

Note: If you are upgrading to 14.1 from previous releases please download and install the bash security update v2 patch (even if Bash Security Update was previously installed). Please see http://kb.juniper.net/JSA10648 [juniper.net]

Workaround

Use access lists or firewall filters to limit access to the Junos Space device only from trusted hosts.

Severity Assessment

OpenSSL vulnerabilities CVE-2012-2110 and CVE-2012-2131 have the highest CVSS v2 base score of 7.5 in this advisory.

Modification History

Modification History:

2014-11-12: Initial publication.
2014-11-17: Corrected the Java and OpenSSL versions in 14.1R1, included additional CVEs that are resolved.
2016-09-07: Corrected the name of Java Runtime Environment used by Junos Space.

Related Information

Acknowledgements