Article Detail

Product Affected

These issues affect Junos OS 21.2, 21.4, 22.2, 22.3, 22.4, 23.2, 23.4. These issues affect Junos OS Evolved 21.2-EVO, 21.4-EVO, 22.2-EVO, 22.3-EVO, 22.4-EVO, 23.2-EVO, 23.4-EVO.

Severity

Medium

Severity Assessment (CVSS) Score

CVSS 3.1: 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

CVSS 4.0: 4.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)

Problem

Multiple vulnerabilities have been resolved in net-SNMP software included with Juniper Networks Junos OS and Junos OS Evolved by upgrading net-SNMP to version 5.9.4, or by fixing vulnerabilities found during internal testing.

For CVE-2015-5621 and CVE-2008-6123 :

These issues affect Junos OS:

All versions before 21.2R3-S8,
from 21.4 before 21.4R3-S7,
from 22.2 before 22.2R3-S4,
from 22.3 before 22.3R3-S3,
from 22.4 before 22.4R3-S2, 22.4R3-S3,
from 23.2 before 23.2R2,
from 23.4 before 23.4R1-S1, 23-4R2.

These issues affect Junos OS Evolved:

All versions before 21.2R3-S8-EVO,
from 21.4-EVO before 21.4R3-S7-EVO,
from 22.2-EVO before 22.2R3-S4-EVO,
from 22.3-EVO before 22.3R3-S3-EVO
from 22.4-EVO before 22.4R3-S2-EVO
from 23.2-EVO before 23.2R2-EVO,
from 23.4-EVO before 23.4R1-S1-EVO, 23.4R2-EVO.

For CVE-2019-20892, CVE-2012-6151, and CVE-2007-5846 these issues were identified during the assessment as present in earlier software releases and already resolved in all engineering-supported releases.

Please note, it is not the policy of Juniper Networks to evaluate the applicability of End of Engineering software yet an exception was made in these particular instances during the investigation of these CVE's.

The following minimal configuration is required to be potentially impacted by these issues:
[snmp]

Important security issues resolved include:

CVE	CVSS	Summary
CVE-2015-5621	5.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L )	The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.
CVE-2008-6123	3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N )	The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to "source/destination IP address confusion."
CVE-2020-15862	0.0 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N)	Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root.
CVE-2020-15861	0.0 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N)	Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.
CVE-2018-18065	0.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N)	_set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.
CVE-2015-8100	0.0 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N)	The net-snmp package in OpenBSD through 5.8 uses 0644 permissions for snmpd.conf, which allows local users to obtain sensitive community information by reading this file.
CVE-2014-3565	0.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N)	snmplib/mib.c in net-snmp 5.7.0 and earlier, when the -OQ option is used, allows remote attackers to cause a denial of service (snmptrapd crash) via a crafted SNMP trap message, which triggers a conversion to the variable type designated in the MIB file, as demonstrated by a NULL type in an ifMtu trap message.
CVE-2014-2310	0.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N)	The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request with an Object ID (OID) containing more subids than previous requests, a different vulnerability than CVE-2012-6151.
CVE-2014-2285	0.0 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N)	The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.
CVE-2019-20892	6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)	net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.
CVE-2012-6151	4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)	Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service (crash or infinite loop, CPU consumption, and hang) by causing the AgentX subagent to timeout.
CVE-2007-5846	7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)	The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value.

Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.

These issues were discovered by a third-party upstream provider.

Solution

The following software releases have been updated to resolve these specific issues:
Junos OS: 21.2R3-S8, 21.4R3-S7, 22.2R3-S4, 22.3R3-S3, 22.4R3-S2, 23.2R2, 23.4R1-S1, 23.4R2, 24.2R1, and all subsequent releases.

Junos OS Evolved: 21.2R3-S8-EVO, 21.4R3-S7-EVO, 22.2R3-S4-EVO, 22.3R3-S3-EVO, 22.4R3-S2-EVO, 23.2R2-EVO, 23.4R1-S1-EVO, 23.4R2-EVO, 24.2R1-EVO, and all subsequent releases.

For CVE-2019-20892, CVE-2012-6151, and CVE-2007-5846 these fixes are already present in End of Engineering support software and therefore listed as resolved and not affecting engineering-supported software.

For CVE-2020-15861, CVE-2020-15862, CVE-2019-20892, CVE-2018-18065, CVE-2015-8100, CVE-2014-3565, CVE-2014-2310, and CVE-2014-2285 these issues do not affect Junos OS or Junos OS Evolved and are included as resolved.

These issues are being tracked as 1775593 which are visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

There are no workarounds for these issues.

To reduce the risk of exploitation of these issues, use access lists or firewall filters to limit access to Junos OS and Junos OS Evolved to only trusted administrative networks, hosts, and users.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History