JVN#07375820
Junos OS vulnerable to directory traversal
Overview
Junos OS provided by Juniper Networks, Inc. contains a directory traversal vulnerability.
Products Affected
- Junos OS 12.3 versions prior to 12.3R12-S13
- Junos OS 12.3X48 versions prior to 12.3X48-D85 on SRX Series
- Junos OS 14.1X53 versions prior to 14.1X53-D51
- Junos OS 15.1F6 versions prior to 15.1F6-S13
- Junos OS 15.1 versions prior to 15.1R7-S5
- Junos OS 15.1X49 versions prior to 15.1X49-D180 on SRX Series
- Junos OS 15.1X53 versions prior to 15.1X53-D238 on QFX5200/QFX5110 Series
- Junos OS 16.1 versions prior to 16.1R4-S13, 16.1R7-S5
- Junos OS 16.2 versions prior to 16.2R2-S10
- Junos OS 17.1 versions prior to 17.1R3-S1
- Junos OS 17.2 versions prior to 17.2R1-S9, 17.2R3-S2
- Junos OS 17.3 versions prior to 17.3R2-S5, 17.3R3-S5
- Junos OS 17.4 versions prior to 17.4R2-S9, 17.4R3
- Junos OS 18.1 versions prior to 18.1R3-S8
- Junos OS 18.2 versions prior to 18.2R3
- Junos OS 18.3 versions prior to 18.3R2-S3, 18.3R3
- Junos OS 18.4 versions prior to 18.4R2
- Junos OS 19.1 versions prior to 19.1R1-S4, 19.1R
Description
Junos OS contains a directory traversal vulnerability (CWE-22).
Impact
Files on the server may be viewed or deleted by an authenticated J-web user.
According to the developer, this issue does not affect system files that can be accessed only by root user.
Solution
Update the Software
Update the software to the latest version according to the information provided by the developer.
Apply a Workaround
Applying a workaround listed below may mitigate the impacts of the vulnerability.
- Limit access to the J-Web interface to only trusted users
Vendor Status
| Vendor | Link |
| Juniper Networks, Inc. | JSA10985 Junos OS: Path traversal vulnerability in J-Web (CVE-2020-1606) |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2020-1606 |
| JVN iPedia |
JVNDB-2020-000002 |