Multiple vulnerabilities have been resolved in the NorthStar Controller Application starting from version 2.1.0 Service Pack 1 and all subsequent releases.

Critical security issues resolved as a result of these upgrades as they apply to Juniper's NorthStar Controller Application are:
 

These issues have been resolved in the NorthStar Controller Application starting in 2.1.0 Service Pack 1 and all subsequent releases.

These issues are being tracked as PRs 1103674, 1103676, 1103678, 1106089, 1106094, 1106801, 1106892, 1107562, 1107564, 1107608, 1108490, 1108919, 1108951, 1109646, 1110003, 1110039, 1112391, 1111575, 1112725, 1112779, 1113092, 1113876, 1114956, 1115789, 1116107, 1116132, 1116168, 1116176, 1116515, 1118661, 1136576, 1178592, 1183288, 1183581, 1183595, 1183610, 1183612, and 1183615, and are visible on the Customer Support website.

KB16765 [juniper.net] - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies.
 

• Limit access to the NorthStar Controller Application from only trusted networks.
• Use administrative jump boxes with no internet access and employ anti-scripting techniques.
• In addition to the recommendations listed above, it is good security practice to limit the exploitable attack surface of critical infrastructure networking equipment. Use access lists or firewall filters to limit access to the devices administrative interfaces only from trusted, administrative networks or hosts.

2017-04-12: Initial publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.
• named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
• The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
• Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.
• named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.
• The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
• The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.
• The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.
• The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
• An authenticated malicious user may cause a buffer overflow leading to a denial of service.
• An unauthenticated, unprivileged, network-based attacker may cause denials of services to underlying database tables leading to potential information disclosure, modification of system states, and partial to full denial of services relying upon data modified by an attacker.
• An authenticated malicious user may read log files which will compromise the integrity of the system, or provide elevation of privileges.
• A malicious attacker may compromise the systems confidentiality or integrity without authentication, leading to managed systems being compromised or services being denied to authentic end users and systems as a result.
• An unauthenticated, unprivileged, network-based attacker may cause various denials of services leading to targeted information disclosure, modification of any component of the NorthStar system, including managed systems, and full denial of services to any systems under management which NorthStar interacts with using read-only or read-write credentials.
• An unauthenticated, unprivileged, network-based attacker may cause various system services partial to full denials of services, modification of system states and files, and potential disclosure of sensitive information which may assist the attacker in further attacks on the system through the use of multiple attack vectors, including man-in-the-middle attacks, file injections, and malicious execution of commands causing out of bound memory conditions leading to other attacks.
• An authenticated user can cause widespread denials of service to system services by consuming tcp and udp ports which are normally reserved for other system services.
• A malicious attacker crafting packets destined to the device may cause a persistent denial of service to the path computation server service.
• A network-based malicious attacker can cause a denial of service via remote command injection.
• An authenticated malicious user may cause a buffer overflow leading to a denial of service.
• An unprivileged, authenticated, network-based attacker can replicate the underlying Junos OS VM and all data it maintains to their local system for future analysis.
• An authenticated malicious user may be able to consume large amounts of system resources leading to a cascading denial of services.
• An unprivileged, authenticated, user can elevate their permissions through reading unprivileged information stored in the NorthStar controller.
• An unprivileged, authenticated, user can execute certain specific unprivileged system files capable of causing widespread denials of system services.
• An unauthenticated, local user, may create a fork bomb scenario, also known as a rabbit virus, or wabbit, which will create processes that replicate themselves, until all resources are consumed on the system, leading to a denial of service to the entire system until it is restarted. Continued attacks by an unauthenticated, local user, can lead to persistent denials of services.
• A network-based malicious attacker can bypass firewall policies, leading to authentication bypass methods, information disclosure, modification of system files, and denials of service.
• An insufficient authentication vulnerability may allow a malicious, network based, unauthenticated attacker to perform privileged actions to gain complete control over the environment.
• A malicious, network-based, authenticated attacker may be able to consume enough system resources to cause a persistent denial of service by visiting certain specific URLs on the server.
• A network-based malicious attacker can perform a man-in-the-middle attack, thereby stealing authentic credentials from encrypted paths which are easily decrypted, and subsequently gain complete control of the system.