InfoSecBulletin Cybersecurity for mankind
Juniper Networks released security updates to fix a critical vulnerability in its SRX Series firewalls and EX Series switches. The vulnerability allows remote code execution (RCE) without authentication.
A critical security flaw named CVE-2024-21591 was found in devices’ J-Web configuration interfaces. It can be exploited by unauthenticated attackers to gain root privileges or launch denial-of-service (DoS) attacks on unpatched devices.
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed
ALERT
Thousands of IP addresses compromised nationwide: CIRT warn
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks
Critical RCE Flaw Patched in Roundcube Webmail
Hacker claim Leak of Deloitte Source Code & GitHub Credentials
CISA Issued Guidance for SIEM and SOAR Implementation
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
“This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory,” the company explained in a security advisory published Wednesday.
Juniper stated that they have found no evidence of the vulnerability being exploited in the real world.
The list of vulnerable Junos OS versions affected by the SRX Series and EX Series J-Web bug is:
Junos OS versions earlier than 20.4R3-S9
Junos OS 21.2 versions earlier than 21.2R3-S7
Junos OS 21.3 versions earlier than 21.3R3-S5
Junos OS 21.4 versions earlier than 21.4R3-S5
Junos OS 22.1 versions earlier than 22.1R3-S4
Junos OS 22.2 versions earlier than 22.2R3-S3
Junos OS 22.3 versions earlier than 22.3R3-S2
Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3
“The bug has been fixed in all subsequent Junos OS releases from 20.4R3-S9 onwards.”
Admins are advised to promptly update their security or upgrade JunOS to the latest version; alternatively, disable the J-Web interface to eliminate the attack possibility.
Another temporary workaround is to restrict J-Web access to only trusted network hosts until patches are deployed.
According to data from nonprofit internet security organization Shadowserver, more than 8,200 Juniper devices have their J-Web interfaces exposed online, most from South Korea (Shodan also tracks over 9,000).
In November, CISA warned about a Juniper exploit called Juniper pre-auth RCE. It is being used by hackers and consists of four bugs known as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847. This exploit affects Juniper’s SRX firewalls and EX switches.
