Article Detail

Product Affected

These issues affect SRC Series

Severity

Critical

Severity Assessment (CVSS) Score

9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Problem

Multiple vulnerabilities have been resolved in Release 4.13.0-R5 of the Juniper Networks Session and Resource Control (SRC) software by updating third party components included within the SRC software or by fixing vulnerabilities found during internal testing.

This issue was discovered during a external security research.

Important security issues resolved in SRC software include:

CVE	CVSS	Summary
CVE-2016-2183	7.5 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N )	The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
CVE-2015-4000	3.7 ( CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N )	The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
CVE-2010-0219	10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)	Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
CVE-2010-1632	7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)	Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.

Solution

These issues have been resolved in SRC 4.13.0-R5 and all subsequent releases.

These issues are being tracked as 1502825 and 1496552 .

Software releases or updates are available for download at https://support.juniper.net/support/downloads/

Workaround

There are no complete workarounds for these issues.

To reduce the risk of exploitation utilize common security BCPs to limit the exploitable surface by limiting access to network and device to trusted systems, administrators, networks and hosts.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History