2024-04 Security Bulletin: Junos OS and Junos OS Evolved: Multiple cURL vulnerabilities resolved.

Product Affected

These issues affect all versions of Junos OS before 21.2R3-S8, 21.4R3-S8, 23.4R1-S1, 23.4R2. These issues affect all versions of Junos OS Evolved before 21.4R3-S4-EVO, 22.1-EVO, 22.3-EVO, 22.4-EVO.

Severity

Medium

Severity Assessment (CVSS) Score

6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Problem

Multiple vulnerabilities have been resolved in Juniper Networks Junos OS and Junos OS Evolved by updating cURL libraries.

These issues affect:

Junos OS:

CVE-2023-38545 and CVE-2023-38546
- All versions before 21.2R3-S8, 21.4R3-S8, 23.4R1-S1, 23.4R2
CVE-2023-23914 and CVE-2023-23915
- All versions before 21.4R3-S5, 22.2R3-S2, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3.
CVE-2020-8284, CVE-2020-8285 and CVE-2020-8286
- All versions before 21.2R1

Junos OS Evolved:

All versions before 21.4R3-S4-EVO,
From 22.1-EVO before 22.1R3-S4-EVO,
From 22.3-EVO before 22.3R3-S1-EVO,
From 22.4-EVO before 22.4R2-S1-EVO.

Important security issues resolved include:

CVE	CVSS	Summary
CVE-2023-38545	6.4 Medium	This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with.
CVE-2023-38546	3.7 Low (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)	This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.
CVE-2023-23914	6.0 Medium	A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly be ignored by subsequent transfers when done on the same command line because the state would not be properly carried on.
CVE-2023-23915	4.4 Medium	A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recently completed transfer. A later HTTP-only transfer to the earlier host name would then not get upgraded properly to HSTS.
CVE-2020-8284	3.7 Low (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)	A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
CVE-2020-8285	4.1 Medium	curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2020-8286	4.1 Medium	curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Additionally, for Junos OS Evolved Only:

CVE	CVSS	Summary
CVE-2018-1000120	6.4 Medium	A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
CVE-2018-1000122	5.7 Medium	A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage

Exploitation Analysis

Junos OS:
CVE-2023-38545 - The SOCKS5 service is not implemented in Junos OS. Further, Junos OS provides VERIEXEC protection to natively protect against the exploitation of this vulnerability. Such an attack would likely follow a chaining pattern, where the attacker first leverages a separate method of exploitation to infiltrate the device. A successful attack against Junos OS would probably demand elevated privileges, shell access, and the ability to circumvent VERIEXEC.
CVE-2023-23914 - A successful attack against Junos OS would probably demand elevated privileges and shell access.
CVE-2023-23915 - A successful attack against Junos OS would probably demand elevated privileges and shell access.
CVE-2020-8284 - A successful attack against Junos OS would probably demand elevated privileges and shell access.
CVE-2020-8285 - Junos OS does not use this option. A successful attack against Junos OS would probably demand elevated privileges and shell access.
CVE-2020-8286 - Junos OS does not use this option. Such an attack would likely follow a chaining pattern, and even then the attacker must breach a TLS server and then provide a fraudulent OCSP response that would appear genuine to the target device. A successful attack against Junos OS would probably demand elevated privileges and shell access.

Junos OS Evolved:
CVE-2018-1000120 - A successful attack against the device would probably demand elevated privileges and shell access and additional advanced attack methods to bypass these built-in security controls.
CVE-2018-1000122 - A successful attacker would have to leverage a malicious RSTP server and would probably demand elevated privileges and shell access.

Solution

The following software releases have been updated to resolve these specific issues:

Junos OS: 21.2R3-S8, 21.4R3-S8, 23.4R1-S1, 23.4R2, 24.2R1, and subsequent releases.
Note for Junos OS: For CVE-2018-1000120 and CVE-2018-1000122 see JSA10874 [juniper.net]. These CVEs are already resolved in earlier releases of Junos OS, they are included in this advisory for Junos OS Evolved only.

Junos OS Evolved: 21.4R3-S4-EVO, 22.1R3-S4-EVO, 22.3R3-S1-EVO, 22.4R2-S1-EVO, 23.2R1-EVO, and subsequent releases.
Note for Junos OS Evolved: CVE-2023-38545 and CVE-2023-38546 Junos OS Evolved is not vulnerable to these CVEs.

These issues are being tracked as 1769149, 1723054, 1562153 and 1347361 which are visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

There are no known workarounds for these issues.

To reduce the risk of exploitation of these issues:

use access lists or firewall filters to limit access to only trusted networks, hosts and users.
limit access to the shell to users on an as-needed basis
discontinue the use of UI services which are not necessary
only enable UI services when necessary and disable them when not needed
implement segmentation for jump-boxes, such as those that do not have internet access
implement MFA procedures
limit access to the device to console services and enable secure services, such as SSH, when only necessary.

These suggestions should be used in conjunction instead of separately with one another when possible.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories.

Modification History

2024-04-10 - Initial Publication
2024-04-23 - Created a full vector string (CVSS 3.1) for CVE-2023-38545 for its applicability to Junos OS
- Vector String example for customers. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C/CR:H/IR:H/AR:H/MAV:L/MAC:H/MPR:H/MUI:N/MS:U/MC:H/MI:H/MA:H.
- Severity: medium
- Score: 5.6
2024-04-26 -
- Updated the list of affected versions of Junos-related CVEs.
- Added a vulnerability analysis section for the most concerning of the CVEs for Junos OS and Junos OS Evolved.
- Modified CVE-2023-38545 again from 5.6 to 6.4, still medium, as the N.V.D. C.N.A. rules require C.N.A.'s to use Base Score modification and not include the environmental score section.
  - It is suggested that customers use the noted example from 2024-04-23 for the extended temporal and environmental score of 5.6. Customers should do so for all CVEs at their discretion.
- Added risk reductions to the workaround section. These are not workarounds.
- Modified the overall security advisory severity rating to Medium to reflect the adjusted vulnerability severity assessments from the exploitation analysis.
2024-07-23: 21.4R3-S8 upgraded which addresses all issues.
2024-07-31: 21.2R3-S8 upgraded which addresses all issues.