An Out-of-bounds Write and Read vulnerability in the polkit framework's pkexec utility as used in Juniper Networks Paragon Active Assurance (Formerly Netrounds (Active Assurance)) incorrectly handled command-line arguments which allows a locally authenticated attacker to craft environment variables of their own in such a way that the pkexec utility will arbitrarily execute code and in doing so, elevate the attackers privileges by running commands as privileged users according to predefined policies to take ownership of the target device.This issue affects:
Juniper Networks Paragon Active Assurance Formerly Netrounds (Active Assurance)
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
This issue was discovered during external security research.
This issue is also known as PwnKit.
This issue has been assigned CVE-2021-4034.
There are no actions for Cloud Hosted Customers to perform. Performing the workaround steps is the solution for On-Prem customer installations.This issue is being tracked as OPS-82.
Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
Software Releases, patches and updates are available at https://support.juniper.net/support/downloads/.
For On-Prem customers you can patch your operating system, for example:
sudo apt update
sudo apt install --only-upgrade policykit-1 libpolkit-gobject-1-0 libpolkit-backend-1-0 libpolkit-agent-1-0
sudo systemctl status polkit.service
Additionally, if there is no patch available for your operating system, you can remove the SUID-bit from pkexec as a temporary mitigation, for example:
# chmod 0755 /usr/bin/pkexec
There is no workaround, or need for one, for Cloud-hosted customers. The services are already fixed.
2022-04-13: Initial Publication.