Multiple vulnerabilities have been resolved in Security Director and Log Collector 17.2R1 release by updating third party software included with Security Director and Log Collector or by fixing vulnerabilities found during internal testing.

Important security issues resolved as a result of these upgrades include:

These issues are resolved in the Security Director and Log Collector 17.2R1 and subsequent releases.
These issues are being tracked as 1309875 and 1290124 which are visible on the Customer Support website.

Software Releases, patches and updates are available at https://www.juniper.net/support/downloads/ .

There are no viable workarounds for these issues.

2018-01-10: Initial Publication.

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2015-5600: OpenSSH: sshd daemon did not check the list of keyboard-interactive authentication methods for duplicates.
• CVE-2015-6563: OpenSSH: a flaw was found in the way OpenSSH handled PAM authentication when using privilege separation.
• CVE-2015-6564: OpenSSH: a use-after-free flaw was found in OpenSSH.
• CVE-2018-0010: Reusable SSH URL authentication token.