An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks Junos OS Evolved allows a low privileged local attacker to view NETCONF traceoptions files, representing an exposure of sensitive information.

On all Junos OS Evolved platforms, when NETCONF traceoptions are configured, NETCONF traceoptions files get created with an incorrect group permission, which allows a low-privileged user can access sensitive information compromising the confidentiality of the system.

Junos OS Evolved: 

• All versions before 20.4R3-S9-EVO, 
• 21.2-EVO before 21.2R3-S7-EVO, 
• 21.4-EVO before 21.4R3-S5-EVO, 
• 22.1-EVO before 22.1R3-S5-EVO, 
• 22.2-EVO before 22.2R3-S3-EVO, 
• 22.3-EVO before 22.3R3-EVO, 22.3R3-S2-EVO, 
• 22.4-EVO before 22.4R3-EVO, 
• 23.2-EVO before 23.2R1-S2-EVO, 23.2R2-EVO.

NETCONF traceoptions are configured within the following Junos hierarchy:

[system services netconf traceoptions]

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was found during internal product security testing or research.

The following software releases have been updated to resolve this specific issue: Junos OS Evolved 20.4R3-S9-EVO, 21.2R3-S7-EVO, 21.3R3-S5-EVO, 21.4R3-S5-EVO, 22.1R3-S5-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-EVO, 23.2R1-S2-EVO, 23.2R2-EVO, 23.4R1-EVO, and all subsequent releases.

Service Restoration:

To completely remediate this issue, any previously written traceoptions log files should be deleted or have their file permissions changed. See Workaround section above for details.

This issue is being tracked as 1752889 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Disable NETCONF traceoptions and delete any existing traceoptions files in /var/log.

Manually modify the permissions of the NETCONF log file to restore the correct group ownership:

user@junos> file change-owner group root /var/log/netconflog.log

2024-10-09: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team