CVE-2023-44194
Assigner: juniper
Published: 2023-10-12T23:04:18.124Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Junos OS
vendor: Juniper Networks
versions: lessThan: 20.4R3-S5
status: affected
version: 0
versionType: semver
lessThan: 21.1R3-S4
status: affected
version: 21.1
versionType: semver
lessThan: 21.2R3-S4
status: affected
version: 21.2
versionType: semver
lessThan: 21.3R3-S3
status: affected
version: 21.3
versionType: semver
lessThan: 21.4R3-S1
status: affected
version: 21.4
versionType: semver
datePublic: 2023-10-11T16:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<p>An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a backdoor with root privileges. The issue is caused by improper directory permissions on a certain system directory, allowing an attacker with access to this directory to create a backdoor with root privileges.</p><p>This issue affects Juniper Networks Junos OS:</p><p></p><ul><li>All versions prior to 20.4R3-S5;</li><li>21.1 versions prior to 21.1R3-S4;</li><li>21.2 versions prior to 21.2R3-S4;</li><li>21.3 versions prior to 21.3R3-S3;</li><li>21.4 versions prior to 21.4R3-S1.</li></ul><p></p>


value: 
An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a backdoor with root privileges. The issue is caused by improper directory permissions on a certain system directory, allowing an attacker with access to this directory to create a backdoor with root privileges.

This issue affects Juniper Networks Junos OS:



  *  All versions prior to 20.4R3-S5;
  *  21.1 versions prior to 21.1R3-S4;
  *  21.2 versions prior to 21.2R3-S4;
  *  21.3 versions prior to 21.3R3-S3;
  *  21.4 versions prior to 21.4R3-S1.







exploits: supportingMedia: base64: no
type: text/html
value: <p>Juniper SIRT is not aware of any malicious exploitation of this vulnerability.</p>
value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-276
description: CWE-276 Incorrect Default Permissions
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: <p>The following software releases have been updated to resolve this specific issue: Junos OS 20.4R3-S5, 21.1R3-S4, 21.2R3-S4, 21.3R3-S3, 21.4R3-S1, 22.1R1, and all subsequent releases.</p>
value: The following software releases have been updated to resolve this specific issue: Junos OS 20.4R3-S5, 21.1R3-S4, 21.2R3-S4, 21.3R3-S3, 21.4R3-S1, 22.1R1, and all subsequent releases.


source: advisory: JSA73158
defect: 1514925
discovery: INTERNAL
timeline: time: 2023-10-11T16:00:00.000Z
value: Initial Publication
title: Junos OS: An unauthenticated attacker with local access to the device can create a backdoor with root privileges
workarounds: supportingMedia: base64: no
type: text/html
value: <p>There are no known workarounds for this issue.</p>
value: There are no known workarounds for this issue.


x_generator: engine: Vulnogram 0.1.0-av217