2019-04-10 22:29:00 2019-04-15 14:31:28

If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password policy can increase the likelihood of success from brute force attacks. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S1; 18.2 versions prior to 18.2R1-S5; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R1-S1.

Vector

NETWORK

Complexity

MEDIUM

Authentication

NONE

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE
Juniper Junos 16.2 R3 (not an official CPE) Juniper Junos 16.2 R2-s8 (not an official CPE) Juniper Junos 16.2 R2-s7 (not an official CPE) Juniper Junos 16.2 R2-s6 (not an official CPE) Juniper Junos 16.2 R2-s5 (not an official CPE) Juniper Junos 16.2 R2-s2 (not an official CPE) Juniper Junos 16.2 R2 (not an official CPE) Juniper Junos 16.2 R1 (not an official CPE) Juniper Junos 16.2 - (not an official CPE) Juniper Junos 16.2 (not an official CPE) Juniper Junos 16.1x65 D48 (not an official CPE) Juniper Junos 16.1x65 (not an official CPE) Juniper Junos 16.1r7-s3 (not an official CPE) Juniper Junos 16.1r6-s6 (not an official CPE) Juniper Junos 16.1r4-s12 (not an official CPE) Juniper Junos 16.1 R7-s5 (not an official CPE) Juniper Junos 16.1 R7-s4 (not an official CPE) Juniper Junos 16.1 R7 (not an official CPE) Juniper Junos 16.1 R6-s1 (not an official CPE) Juniper Junos 16.1 R5-s4 (not an official CPE) Juniper Junos 16.1 R4 (not an official CPE) Juniper Junos 16.1 R3-s10 (not an official CPE) Juniper Junos 16.1 R3 (not an official CPE) Juniper Junos 16.1 R2 (not an official CPE) Juniper Junos 16.1 R1 (not an official CPE) Juniper Junos 16.1 - (not an official CPE) Juniper Junos 16.1 (not an official CPE) Juniper Junos 15.1x53-d591 (not an official CPE) Juniper Junos 15.1x53-d495 (not an official CPE) Juniper Junos 15.1x53-d69 (not an official CPE) Juniper Junos 15.1x53 D70 (not an official CPE) Juniper Junos 15.1x53 D63 (not an official CPE) Juniper Junos 15.1x53 D62 (not an official CPE) Juniper Junos 15.1x53 D61 (not an official CPE) Juniper Junos 15.1x53 D60 (not an official CPE) Juniper Junos 15.1x53 D56 (not an official CPE) Juniper Junos 15.1x53 D45 (not an official CPE) Juniper Junos 15.1x53 D40 (not an official CPE) Juniper Junos 15.1x53 D34 (not an official CPE) Juniper Junos 15.1x53 D33 (not an official CPE) Juniper Junos 15.1x53 D32 (not an official CPE) Juniper Junos 15.1x53 D30 (not an official CPE) Juniper Junos 15.1x53 D25 (not an official CPE) Juniper Junos 15.1x53 D210 (not an official CPE) Juniper Junos 15.1x53 D21 (not an official CPE) Juniper Junos 15.1x53 D20 (not an official CPE) Juniper Junos 15.1x49 D80 (not an official CPE) Juniper Junos 15.1x49 D75 (not an official CPE) Juniper Junos 15.1x49 D70 (not an official CPE) Juniper Junos 15.1x49 D65 (not an official CPE) Juniper Junos 15.1x49 D60 (not an official CPE) Juniper Junos 15.1x49 D55 (not an official CPE) Juniper Junos 15.1x49 D50 (not an official CPE) Juniper Junos 15.1x49 D45 (not an official CPE) Juniper Junos 15.1x49 D40 (not an official CPE) Juniper Junos 15.1x49 D35 (not an official CPE) Juniper Junos 15.1x49 D30 (not an official CPE) Juniper Junos 15.1x49 D20 (not an official CPE) Juniper Junos 15.1x49 D150 (not an official CPE) Juniper Junos 15.1x49 D10 (not an official CPE) Juniper Junos 15.1r7-s3 (not an official CPE) Juniper Junos 15.1 R7-s3 (not an official CPE) Juniper Junos 15.1 R7-s2 (not an official CPE) Juniper Junos 15.1 R6-s6 (not an official CPE) Juniper Junos 15.1 R6 (not an official CPE) Juniper Junos 15.1 R5 (not an official CPE) Juniper Junos 15.1 R4-s9 (not an official CPE) Juniper Junos 15.1 R4 (not an official CPE) Juniper Junos 15.1 R3 (not an official CPE) Juniper Junos 15.1 R2 (not an official CPE) Juniper Junos 15.1 R1 Juniper Junos 15.1 F7 (not an official CPE) Juniper Junos 15.1 F6 (not an official CPE) Juniper Junos 15.1 F5 (not an official CPE) Juniper Junos 15.1 F4 (not an official CPE) Juniper Junos 15.1 F3 (not an official CPE) Juniper Junos 15.1 F2-s4 (not an official CPE) Juniper Junos 15.1 F2-s3 (not an official CPE) Juniper Junos 15.1 F2-s2 (not an official CPE) Juniper Junos 15.1 F2-s1 (not an official CPE) Juniper Junos 15.1 F2 (not an official CPE) Juniper Junos 15.1 F1 (not an official CPE) Juniper Junos 15.1 A1 (not an official CPE) Juniper Junos 14.1x53 R1 (not an official CPE) Juniper Junos 14.1x53 D45 (not an official CPE) Juniper Junos 14.1x53 D40 (not an official CPE) Juniper Junos 14.1x53 D35 (not an official CPE) Juniper Junos 14.1x53 D30 (not an official CPE) Juniper Junos 14.1x53 D27 (not an official CPE) Juniper Junos 14.1x53 D26 (not an official CPE) Juniper Junos 14.1x53 D25 (not an official CPE) Juniper Junos 14.1x53 D16 (not an official CPE) Juniper Junos 14.1x53 D15 (not an official CPE) Juniper Junos 14.1x53 D10 (not an official CPE) Juniper Junos 14.1x53 - (not an official CPE) Juniper Junos 14.1x53 (not an official CPE) Juniper Junos 17.1 (not an official CPE) Juniper Junos 17.1 - (not an official CPE) Juniper Junos 17.1 R1 (not an official CPE) Juniper Junos 17.1 R2-s10 (not an official CPE) Juniper Junos 17.1 R2-s2 (not an official CPE) Juniper Junos 17.1 R2-s3 (not an official CPE) Juniper Junos 17.1 R2-s4 (not an official CPE) Juniper Junos 17.1 R2-s5 (not an official CPE) Juniper Junos 17.1 R2-s6 (not an official CPE) Juniper Junos 17.1 R2-s7 (not an official CPE) Juniper Junos 17.1r3 (not an official CPE) Juniper Junos 17.2 (not an official CPE) Juniper Junos 17.2 - (not an official CPE) Juniper Junos 17.2 R1-s2 (not an official CPE) Juniper Junos 17.2 R1-s4 (not an official CPE) Juniper Junos 17.2 R1-s7 (not an official CPE) Juniper Junos 17.2 R1-s8 (not an official CPE) Juniper Junos 17.2 R3-s1 (not an official CPE) Juniper Junos 17.2r3-s1 (not an official CPE) Juniper Junos 17.3 (not an official CPE) Juniper Junos 17.3 - (not an official CPE) Juniper Junos 17.3 R2 (not an official CPE) Juniper Junos 17.3 R2-s1 (not an official CPE) Juniper Junos 17.3 R2-s2 (not an official CPE) Juniper Junos 17.3 R3-s1 (not an official CPE) Juniper Junos 17.3 R3-s2 (not an official CPE) Juniper Junos 17.3 R3-s3 (not an official CPE) Juniper Junos 17.3 R3-s4 (not an official CPE) Juniper Junos 17.3r3 (not an official CPE) Juniper Junos 17.4 (not an official CPE) Juniper Junos 17.4 - (not an official CPE) Juniper Junos 17.4 R1 (not an official CPE) Juniper Junos 17.4 R1-s1 (not an official CPE) Juniper Junos 17.4 R1-s2 (not an official CPE) Juniper Junos 17.4 R1-s4 (not an official CPE) Juniper Junos 17.4 R1-s6 (not an official CPE) Juniper Junos 17.4 R1-s7 (not an official CPE) Juniper Junos 17.4 R2 (not an official CPE) Juniper Junos 17.4 R2-s3 (not an official CPE) Juniper Junos 17.4 R2-s4 (not an official CPE) Juniper Junos 17.4r2-s2 (not an official CPE) Juniper Junos 18.1 - (not an official CPE) Juniper Junos 18.1 R2 (not an official CPE) Juniper Junos 18.1 R2-s4 (not an official CPE) Juniper Junos 18.1 R3-s3 (not an official CPE) Juniper Junos 18.1 R3-s4 (not an official CPE) Juniper Junos 18.1r3-s1 (not an official CPE) Juniper Junos 18.2 (not an official CPE) Juniper Junos 18.2 - (not an official CPE) Juniper Junos 18.2 R1-s5 (not an official CPE) Juniper Junos 18.2 R2-s1 (not an official CPE) Juniper Junos 18.2 R2-s2 (not an official CPE) Juniper Junos 18.2 R2-s3 (not an official CPE) Juniper Junos 18.2 R3 (not an official CPE) Juniper Junos 18.2x75 (not an official CPE) Juniper Junos 18.2x75 D40 (not an official CPE) Juniper Junos 18.3 (not an official CPE) Juniper Junos 18.3 - (not an official CPE) Juniper Junos 18.3 R1-s1 (not an official CPE) Juniper Junos 18.3 R1-s2 (not an official CPE) Juniper Junos 18.3 R1-s3 (not an official CPE)
Advisory Patch Confirmed Link
https://kb.juniper.net/JSA10928
107899