CVE-2024-39544

Summary

An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks Junos OS Evolved allows a low privileged local attacker to view NETCONF traceoptions files, representing an exposure of sensitive information.

On all Junos OS Evolved platforms, when NETCONF traceoptions are configured, NETCONF traceoptions files get created with an incorrect group permission, which allows

a low-privileged user can access sensitive information compromising the confidentiality of the system.

Junos OS Evolved: 

  • All versions before 20.4R3-S9-EVO, 
  • 21.2-EVO before 21.2R3-S7-EVO, 
  • 21.4-EVO before 21.4R3-S5-EVO, 
  • 22.1-EVO before 22.1R3-S5-EVO, 
  • 22.2-EVO before 22.2R3-S3-EVO, 
  • 22.3-EVO before 22.3R3-EVO, 22.3R3-S2-EVO, 
  • 22.4-EVO before 22.4R3-EVO, 
  • 23.2-EVO before 23.2R1-S2-EVO, 23.2R2-EVO.

Affected Software

VendorProductVersion RangeStatus
Juniper NetworksJunos OS Evolved0 < 20.4R3-S9-EVOaffected
Juniper NetworksJunos OS Evolved21.2-EVO < 21.2R3-S7-EVOaffected
Juniper NetworksJunos OS Evolved21.4-EVO < 21.4R3-S5-EVOaffected
Juniper NetworksJunos OS Evolved22.1-EVO < 22.1R3-S5-EVOaffected
Juniper NetworksJunos OS Evolved22.2-EVO < 22.2R3-S3-EVOaffected
Juniper NetworksJunos OS Evolved22.3-EVO < 22.3R3-S2-EVOaffected
Juniper NetworksJunos OS Evolved22.4-EVO < 22.4R3-EVOaffected
Juniper NetworksJunos OS Evolved23.2-EVO < 23.2R1-S2-EVO, 23.2R2-EVOaffected

Weaknesses

  • CWE-276: CWE-276 Incorrect Default Permissions

Workarounds

Disable NETCONF traceoptions and delete any existing traceoptions files in /var/log.

Manually modify the permissions of the NETCONF log file to restore the correct group ownership:

user@junos> file change-owner group root /var/log/netconflog.log

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References