The Juniper Device Manager (JDM) container, used by the disaggregated Junos OS architecture on Juniper Networks NFX350 Series devices, stores password hashes in the world-readable file /etc/passwd. This is not a security best current practice as it can allow an attacker with access to the local filesystem the ability to brute-force decrypt password hashes stored on the system.

This issue affects Juniper Networks Junos OS on NFX350:

• 19.4 versions prior to 19.4R3;
• 20.1 versions prior to 20.1R1-S4, 20.1R2.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was found during internal product security testing or research.

This issue has been assigned  CVE-2020-1669 .
 

Junos OS now stores local password hashes in the protected /etc/shadow file.

The following software releases have been updated to resolve this specific issue: Junos OS 19.4R3, 20.1R1-S4, 20.1R2, 20.2R1, and all subsequent releases.

This issue is being tracked as  1462556 .
 

Software releases or updates are available for download at https://www.juniper.net/support/downloads/ .
 

Use access lists or firewall filters to limit access to the device only from trusted hosts.

Limit shell access to only trusted system administrators.
 

2020-10-14: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2020-1669 at cve.mitre.org