libfetch(3) is a multi-protocol file transfer library included with Juniper Networks Junos OS and used by various command-line programs. A programming error allows an attacker who can specify a URL with username and/or password components to overflow libfetch(3) buffers. An attacker in control of the URL to be fetched (possibly via HTTP redirect) may cause a heap buffer overflow, resulting in program misbehavior or malicious code execution.

This issue affects Juniper Networks Junos OS:

• 15.1 versions prior to 15.1R7-S8;
• 17.2X75 versions prior to 17.2X75-D45;
• 17.3 versions prior to 17.3R3-S9;
• 17.4 versions prior to 17.4R2-S10, 17.4R3-S2;
• 18.1 versions prior to 18.1R3-S10;
• 18.2 versions prior to 18.2R2-S7, 18.2R3-S5;
• 18.2X75 versions prior to 18.2X75-D34, 18.2X75-D430, 18.2X75-D53, 18.2X75-D60;
• 18.3 versions prior to 18.3R2-S4, 18.3R3-S2;
• 18.4 versions prior to 18.4R1-S6, 18.4R2-S4, 18.4R3-S2;
• 19.1 versions prior to 19.1R1-S5, 19.1R2-S1, 19.1R3;
• 19.2 versions prior to 19.2R1-S4, 19.2R2;
• 19.3 versions prior to 19.3R2-S2, 19.3R3;
• 19.4 versions prior to 19.4R1-S1, 19.4R2.

This issue only affects Junos OS 15.1R1 and subsequent releases. Junos OS 15.1X49, and earlier versions of Junos OS, are unaffected by this vulnerability.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue has been assigned  CVE-2020-7450 .

The following software releases have been updated to resolve this specific issue: 15.1R7-S8, 17.2X75-D45, 17.3R3-S9, 17.4R2-S10, 17.4R3-S2, 18.1R3-S10, 18.2R2-S7, 18.2R3-S5, 18.2X75-D34, 18.2X75-D430, 18.2X75-D53, 18.2X75-D60, 18.3R2-S4, 18.3R3-S2, 18.4R1-S6, 18.4R2-S4, 18.4R3-S2, 19.1R1-S5, 19.1R2-S1, 19.1R3, 19.2R1-S4, 19.2R2, 19.3R2-S2, 19.3R3, 19.4R1-S1, 19.4R2, 20.1R1, and all subsequent releases.

This issue is being tracked as  1485743 .
 

Software releases or updates are available for download at https://www.juniper.net/support/downloads/ .
 

2020-10-14: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2020-7450 at cve.mitre.org