Article Detail

Product Affected

This issue affects Network and Security Manager Appliance 2012.2.

Severity

High

Severity Assessment (CVSS) Score

7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Problem

Multiple vulnerabilities potentially affect NSMs OS have been resolved in the CentOS 6.5-based 2012.2R12 release.

Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.

Important security issues resolved as a result of these upgrades include:

CVE	CVSS	Summary
CVE-2015-5157	7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)	arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI.
CVE-2016-1583	7.8 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H )	The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.
CVE-2016-4565	7.8 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H )	The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface.
CVE-2016-5829	7.8 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H )	Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.
CVE-2015-2925	6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)	The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."
CVE-2015-7613	6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)	Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.
CVE-2015-8543	7.0 ( CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H )	The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application.
CVE-2016-2143	7.8 ( CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H )	The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.
CVE-2015-5156	6.1 (AV:A/AC:L/Au:N/C:N/I:N/A:C)	The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.
CVE-2016-5696	4.8 ( CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L )	net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.
CVE-2016-0774	6.8 ( CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H )	The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.
CVE-2015-8767	7.5 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H )	net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does not properly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call.
CVE-2010-5313	4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)	Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842.
CVE-2015-5307	4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)	The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.
CVE-2015-7550	5.5 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H )	The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls.
CVE-2015-8324	4.6 ( CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H )	The ext4 implementation in the Linux kernel before 2.6.34 does not properly track the initialization of certain data structures, which allows physically proximate attackers to cause a denial of service (NULL pointer dereference and panic) via a crafted USB device, related to the ext4_fill_super function.
CVE-2016-2550	5.5 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H )	The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.
CVE-2016-4470	5.5 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H )	The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.
CVE-2015-8104	4.7 (AV:L/AC:M/Au:N/C:N/I:N/A:C)	The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.
CVE-2014-8134	2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)	The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.
CVE-2015-7872	2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)	The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands.

Solution

The following software releases have been updated to resolve this specific issue: 2012.2R12, and all subsequent releases on NSM Appliance.

CentOS 5.7 has reached End of Engineering; customers should upgrade NSM Appliances to CentOS 6.5 to receive ongoing updates.

Customers using software-only package, supplying their own operating systems, should apply updates on their operating systems.

This issue is being tracked as PR 1107641 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Software Releases, patches and updates are available at https://www.juniper.net/support/downloads/ .

Workaround

There are no viable workarounds for these issues.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History