ESB-2018.0087 - [Juniper] Juniper appliances: Access privileged data - Existing account - 2018-01-08


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.0087
2018-01 Out of Cycle Security Bulletin: Meltdown & Spectre: CPU Speculative
   Execution and Indirect Branch Prediction Side Channel Analysis Method
                              8 January 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Juniper appliances
Publisher:         Juniper Networks
Operating System:  Juniper
Impact/Access:     Access Privileged Data -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-5754 CVE-2017-5753 CVE-2017-5715

Reference:         ASB-2018.0002.4
                   ESB-2018.0080
                   ESB-2018.0079
                   ESB-2018.0046
                   ESB-2018.0044
                   ESB-2018.0042

Original Bulletin: 
   https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10842

- --------------------------BEGIN INCLUDED TEXT--------------------

2018-01 Out of Cycle Security Bulletin: Meltdown & Spectre: CPU Speculative 
Execution and Indirect Branch Prediction Side Channel Analysis Method

Product Affected:

See Problem and Solution sections below.

Problem:
Modern microprocessors that implement speculative execution of instructions 
are susceptible to a new class of cache timing attacks being called "Meltdown"
and "Spectre".  These vulnerabilities could allow an attacker to read
privileged memory which may contain sensitive information such as passwords or
encryption keys.

There are three known variants of the issue:

    Variant 1: bounds check bypass (CVE-2017-5753)
    Variant 2: branch target injection (CVE-2017-5715)
    Variant 3: rogue data cache load (CVE-2017-5754)

Almost all modern CPUs, including the ones in most Juniper products, use 
speculative execution and are potentially susceptible to these types of 
attacks. However, it is important to note that in order to exploit this 
weakness and gain access to restricted memory, the attack requires executing
crafted code on the device. Many networking devices from Juniper can only
execute code signed by Juniper.  In these devices there is no exposure to
privileged memory being read by an unauthorized user.

Deployments where users can execute arbitrary code, including many virtualized,
container, Flex, and application products are potentially impacted.  Customers
should follow standard BCPs to limit exposure and apply fixes as they become
available.
 
Solution:
Product Status:
Juniper SIRT is actively investigating the impact on Juniper Networks products
and services. 

The following products may be impacted if deployed in a way that allows
unsigned code execution:

    Junos OS based platforms
    Junos Space appliance
    Qfabric Director
    CTP Series
    NSMXpress/NSM3000/NSM4000 appliances 
    STRM/Juniper Secure Analytics (JSA) appliances
    SRC/C Series


The following products are not impacted:

    ScreenOS / Netscreen platforms
    JUNOSe / E Series platforms
    BTI platforms


Juniper is continuing to investigate our product portfolio for affected 
products that are not mentioned above. As new information becomes available 
this document will be updated.

Where possible, Juniper will be developing software fixes that prevent these
type of attacks.  This JSA will be updated as those fixes become available for
Juniper devices.
 
Workaround:
In order to mitigate this vulnerability, only run software from trusted 
sources.  It is also recommended to limit the access to critical infrastructure
networking equipment to only trusted administrators from trusted administrative
networks or hosts.
 
Modification History:

2018-01-05: Initial publication

Related Links:

    Intel: Speculative Execution and Indirect Branch Prediction Side Channel
    Analysis Method

    Intel Responds to Security Research Findings

    Intel: Facts about The New Security Research Findings and Intel Products

    Project Zero: Reading privileged memory with a side-channel

    KB16613: Overview of the Juniper Networks SIRT Quarterly Security 
    Bulletin Publication Process

    KB16765: In which releases are vulnerabilities fixed?

    KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security
    Advisories

    Report a Vulnerability - How to Contact the Juniper Networks Security 
    Incident Response Team

CVSS Score:
4.1 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)

Risk Level:
Low

Risk Assessment:
In the case of Junos OS, in order to exploit this vulnerability an attacker 
must have a local authenticated privileged (admin) and needs to bypass the image 
validation checking.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWlL8VIx+lLeg9Ub1AQgVFBAAgXX+5B1ZHtN35WPOE65XCVJQ4vMW2l32
bp/12gjnbo9kSWwb/05ocq3HZn13W2uB2y7XXarHV5PeCksAMUUFotsZa/8QH0Jc
5njF9FT4kabmLF+OAaoP1MMkoxTn7OcJ0MucgMPvHC4eloty/XlG/b7H28umGRf5
aegXec8WjuP+i7W1X43NUFH42inCezqLxoJA/93ELtHv+VKACAF2Sib6e8eQWcW7
4VUmKjBxqH0acY3PjjshuJAiA2CzhzH9BEAKyH2jMGNInwnO7IN0rxB9+H2QkjEa
WO+qkryeedpW0F2u0UnsMsJjxV1KjHk1aJJJie24F/BY5fwnPEFOziE4gRbtz6Ud
ci9CzpXEvcadtpYPa4Ck2ij8yGoAo7g4cAMlLmmpG7dJ/wroKsqADuC7w92ytbHo
xldMIhBar94Ek/sR/ZYxyuJGpPQxsY+rlCl8sfB88ny79t8jES17zRdLc+qPBXcn
jwkxIyOyU7XbXlNpQHekNlz9eUQSMDH/H/ykBHyWf+aHmMDUjg8QzuJAKvgy0YSv
2fgr9iOiHKikvVJOlvUQuvPTcB2+G8VpX5g2usbP8l/Bbo8tPed6JTE+ABp6TwGj
uyu7+7EDLg4ZeoSK6ZzIf6mCxRVWCrLuydIkLsZjlrj7hWDBszqWy27hcz5nSqhx
fQTN1ndZ9/M=
=LrHk
-----END PGP SIGNATURE-----