Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2014.2140 Network and Security Manager NSM Appliances: Multiple vulnerabilities 13 November 2014 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Juniper NSM3000 Appliance Juniper NSMXpress Appliance Publisher: Juniper Networks Operating System: Network Appliance Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Denial of Service -- Remote/Unauthenticated Unauthorised Access -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2014-7187 CVE-2014-7186 CVE-2014-7169 CVE-2014-6278 CVE-2014-6277 CVE-2014-6271 CVE-2014-2532 CVE-2011-5000 CVE-2010-5107 CVE-2010-4755 Reference: ASB-2014.0115 ASB-2014.0114 ASB-2014.0111 ESB-2014.2132 ESB-2014.1672 ESB-2014.1671 ESB-2014.1670 ESB-2014.1669.2 Original Bulletin: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10661 - --------------------------BEGIN INCLUDED TEXT-------------------- 2014-11 Security Bulletin: Network and Security Manager NSM Appliances: Multiple vulnerabilities Categories: NSMXpress NSM NSM3000 SIRT Advisory Security Advisories ID: JSA10661 Last Updated: 11 Nov 2014 Version: 1.0 PRODUCT AFFECTED: NSM3000 and NSMXpress Appliances with NSM release 2012.2 PROBLEM: Third party software upgrades provided with NSM offline or online upgrade package v3 resolve the following vulnerabilities that affect NSM 2012.2 releases on NSM Appliances NSM3000 and NSMXpress: CVE CVSS v2 base score Summary CVE-2014-6271 CVE-2014-7169 10 Bash shell command injection CVE-2014-7186 CVE-2014-7187 (AV:N/AC:L/Au:N/C:C/I:C/A:C) vulnerability also known as CVE-2014-6277 CVE-2014-6278 "ShellShock". See JSA10648 CVE-2014-2532 5.8 OpenSSH vulnerability that may (AV:N/AC:M/Au:N/C:P/I:P/A:N) allow remote attackers to bypass intended environment restrictions. CVE-2010-5107 5.0 OpenSSH default insecure (AV:N/AC:L/Au:N/C:N/I:N/A:P) configuration that can result in a denial of service condition. CVE-2010-4755 4.0 OpenSSH SFTP denial of service (AV:N/AC:L/Au:S/C:N/I:N/A:P) condition in due to crafted glob expressions. CVE-2011-5000 3.5 OpenSSH denial of service (AV:N/AC:M/Au:S/C:N/I:N/A:P) vulnerability related to GSS API. Note: NSM server software installed on generic Linux or Solaris servers may require OpenSSH fixes from server OS vendor. SOLUTION: All these issues are fixed by "NSM Appliance Generic Offline Upgrade Package_v3 - CentOS 5.x" or "NSM Appliance Generic Online Upgrade Script_v3_CentOS5.x" (released Sep 30, 2014) or later. These are available for download from https://www.juniper.net/support/downloads/?p=nsm#sw. WORKAROUND: Use access lists or firewall filters to limit access to the NSM server only from trusted hosts. IMPLEMENTATION: NSM Appliance Upgrade Package_v3 are available at http://www.juniper.net/support/downloads/?p=nsm#sw. MODIFICATION HISTORY: 2014-11-14: Initial publication. RELATED LINKS: KB16613: Overview of the Juniper Networks SIRT Monthly Security Bulletin Publication Process KB16765: In which releases are vulnerabilities fixed? KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team CVSS SCORE: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) RISK LEVEL: Medium RISK ASSESSMENT: Since ShellShock vulnerabilities were alerted in JSA10648, CVE-2014-2532 with CVSS score of 5.8 is used to determine the risk level associated with this advisory. ACKNOWLEDGEMENTS: - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBVGQEVBLndAQH1ShLAQIWTg//QD5Wr9RfiZqdpQPCeeIIhQ3ThX6tYUaz cXCxJUsmH7aHmUtzmRZ58FoFgtHPe0SOe7qnu87/g0jsmA4Sd7GTC1YQIeKrp+8L WODztPtEKFQGRKil5fkbxcGK5bKlYxxvxLuGv8TgmnuZz8VBUgKv1QjrzVU+GAxb K47CAiLbFsAZNLhhIHddodKjF2llVPf1k+l4mPjjiMjG9d+/7zffgJBrv/sw1klX z+YTBHCGRu/Deg88cPjICc5pGj36psCgpXHm2GUlf4nvl6zsWAg3lkdSwFaSDXtv ogBZA409pexTjOt5eraVTxz2Rn+2FFiB8+JqVd/lYWXBhRQ3mj41e20mr51tuOD+ 01McqFYzlpua3nb+X4mv20IhS+7t4FvHKCFsBEdLIyTny+ZBaNXHmg9jvRwBYKXs ZWbGJHjbnWAQmwauk6dzP3nbJT/GFc0fkUfO6oDVsdJlg/ueGCRQ6y3gyhtdO7Kd 84CFaKIWADDXMAULeYx1C43XwWQ7/tVVgzC0RXQSNOfZsi4RHqwLBYFbPhSb6c5n MmzrcGBuIvLHAMqf2kFPrMpUlE6PlT0X5qXXFbXrK7joc8LGZhbHeFtXhb4P6il/ Xs/Q1Mu5iF1rfKfU8GTdtpYO/sQIFZEo8xAnvxO07uT/IkjmcvyEpe3pkEJ+f6YG R/SU0lIwlWE= =S/4B -----END PGP SIGNATURE-----