Lucene search

JuniperCVE-2017-10606

HistoryOct 13, 2017 - 5:29 p.m.

CVE-2017-10606

2017-10-1317:29:00

juniper

web.nvd.nist.gov

cve-2017-10606

juniper networks

tpm

firmware

cryptographic keys

weakness

decryption

srx300 series

nvd

security vulnerability

information security

encryption

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

Percentile

12.6%

JSON

Version 4.40 of the TPM (Trusted Platform Module) firmware on Juniper Networks SRX300 Series has a weakness in generating cryptographic keys that may allow an attacker to decrypt sensitive information in SRX300 Series products. The TPM is used in the SRX300 Series to encrypt sensitive configuration data. While other products also ship with a TPM, no other products or platforms are affected by this vulnerability. Customers can confirm the version of TPM firmware via the ‘show security tpm status’ command. This issue was discovered by an external security researcher. No other Juniper Networks products or platforms are affected by this issue.

Affected configurations

Nvd

Node

junipertrusted_platform_module_firmwareMatch4.40

AND

junipersrx300Match-

junipersrx320Match-

junipersrx340Match-

junipersrx345Match-

VendorProductVersionCPE
junipertrusted_platform_module_firmware4.40cpe:2.3:o:juniper:trusted_platform_module_firmware:4.40:*:*:*:*:*:*:*
junipersrx300-cpe:2.3:h:juniper:srx300:-:*:*:*:*:*:*:*
junipersrx320-cpe:2.3:h:juniper:srx320:-:*:*:*:*:*:*:*
junipersrx340-cpe:2.3:h:juniper:srx340:-:*:*:*:*:*:*:*
junipersrx345-cpe:2.3:h:juniper:srx345:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
juniper	trusted_platform_module_firmware	4.40	cpe:2.3:o:juniper:trusted_platform_module_firmware:4.40:::::::*
juniper	srx300	-	cpe:2.3:h:juniper:srx300:-:::::::*
juniper	srx320	-	cpe:2.3:h:juniper:srx320:-:::::::*
juniper	srx340	-	cpe:2.3:h:juniper:srx340:-:::::::*
juniper	srx345	-	cpe:2.3:h:juniper:srx345:-:::::::*

CNA Affected

[
  {
    "platforms": [
      "SRX300 Series"
    ],
    "product": "Junos OS",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "status": "affected",
        "version": "15.1X49 prior to TPM firmware version 4.43"
      }
    ]
  }
]

References

kb.juniper.net/JSA10809

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2017-10606