Juniper SRX3600

Junos OS: Upon receipt of certain types of malformed PCEP packets the pccd process may crash.

SRX series: Junos OS: SRX series using IPv6 Sun/MS-RPC ALGs may experience flowd crash on processing packets.

Junos OS: SRX Series: Denial of service vulnerability in flowd daemon upon receipt of a specific fragmented packet

Junos OS: SRX Series: Memory leak when querying Aggregated Ethernet (AE) interface statistics

Junos OS: MX and SRX series: Flowd core observed if the SIP ALG is enabled and a specific Session Initiation Protocol (SIP) packet is received

SRX Series and MX Series with SPC3: A high percentage of fragments might lead to high latency or packet drops

Junos OS: MX MS-MPC or MS-MIC, or SRX SPC crashes if it receives a SIP message with a specific contact header format

Junos OS: SRX Series and EX Series: J-Web - unauthenticated access to temporary files containing sensitive information

Junos OS: Cross-Site Scripting (XSS) in J-Web

Junos OS: SRX series: The PFE will crash when specific traffic is scanned by Enhanced Web Filtering safe-search

Junos OS: SRX Series: An FPC memory leak can occur in an APBR scenario

Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash when specific H.323 packets are received

Junos OS: MX Series and SRX Series: The flowd daemon will crash if the SIP ALG is enabled and specific SIP messages are processed

SRX Series: If Unified Threat Management (UTM) Enhanced Content Filtering (CF) is enabled and specific traffic is processed the PFE will crash

Junos OS: SRX Series and MX Series: When specific valid SIP packets are received the PFE will crash

Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if SIP ALG is enabled and a malformed SIP packet is received

Junos OS: SRX Series: A memory leak might be observed in IPsec VPN scenario leading to an FPC crash

Junos OS: SRX Series: A flowd core will be observed when malformed GPRS traffic is processed

Junos OS: SRX Series: jbuf memory leak when SSL Proxy and UTM Web-Filtering is applied

SRX Series and MX Series: An FPC core is observed when IDP is enabled on the device and a specific malformed SSL packet is received

Junos OS: SRX Series and MX Series: Memory leak due to receipt of specially crafted SIP calls

Junos OS: SRX Series: The flow processing daemon (flowd) will crash when Unified Policies are used with IPv6 and certain dynamic applications are rejected by the device

Junos OS: SRX Series: When "tcp-encap" is configured and specific packets are received flowd will crash

Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if the SIP ALG is enabled and specific SIP messages are processed

Junos OS: SRX Series: Upon processing of a genuine packet the pkid process will crash during CMPv2 auto-re-enrollment

Junos OS: SRX Series: An attacker may be able to perform Man-in-the-Middle (MitM) attacks during app-id signature updates.

SRX Series: Antivirus updates are downloaded without verification

Junos OS: commit script may allow unauthenticated root login upon reboot

Juniper Junos 10.4S before 10.4S15, 10.4R before 10.4R16, 11.4 before 11.4R9, and 12.1R before 12.1R7 on SRX Series service gateways allows remote attackers to cause a denial of service (flowd crash) via a crafted IP packet.

Junos OS: MX Series with SPC3, and SRX Series: If specific IPsec parameters are negotiated iked will crash due to a memory leak

Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, and 12.3X48 before 12.3X48-D10 on SRX series devices does not properly enforce the log-out-on-disconnect feature when configured in the [system port console] stanza, which allows physically proximate attackers to reconnect to the console port and gain administrative access by leveraging access to the device.

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.

Buffer overflow in the flow daemon (flowd) in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7-S2, 12.1.X44 before 12.1X44-D15, 12.1X45 before 12.1X45-D10 on SRX devices, when using telnet pass-through authentication on the firewall, might allow remote attackers to execute arbitrary code via a crafted telnet message.

DNS forwarders - cache poisoning vulnerability

The Juniper SRX Series devices with Junos 11.4 before 11.4R12-S4, 12.1X44 before 12.1X44-D40, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D25, and 12.1X47 before 12.1X47-D10, when an Application Layer Gateway (ALG) is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted packet.

Junos OS: SRX Series and MX Series with SPC3: When IPsec VPN is configured iked will core when a specifically formatted payload is received

Junos: FTPS through SRX opens up wide range of data channel TCP ports

Junos OS: User-defined ARP Policer isn't applied on Aggregated Ethernet (AE) interface until firewall process is restarted

Junos OS: MX Series with SPC3, and SRX Series: When IPsec authentication is configured with "hmac-sha-384" and "hmac-sha-512" no authentication of traffic is performed

Junos OS: A malicious crafted IPv6 DHCP packet may cause the JDHCPD daemon to core