CVE-2017-2320: Infoleak
A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various denials of services leading to targeted information disclosure, modification of any component of the NorthStar system, including managed systems, and full denial of services to any systems under management which NorthStar interacts with using read-only or read-write credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks NorthStar Controller Applicationto a version that resolves this vulnerability.Fixed in 2.1.0 Service Pack 1 - Compensating control
Given the risk of a network-based attacker, restrict access to the NorthStar Controller Application from untrusted networks (e.g., limit inbound access to only required management sources/addresses via network controls such as firewall/ACL).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2320?
CVE-2017-2320 has been classified as a high severity vulnerability due to its potential for denial of service attacks.
How do I fix CVE-2017-2320?
To fix CVE-2017-2320, upgrade the Juniper Networks NorthStar Controller Application to version 2.1.0 Service Pack 1 or a later version.
Who is affected by CVE-2017-2320?
Any organization using Juniper Networks NorthStar Controller Application versions prior to 2.1.0 Service Pack 1 is affected by CVE-2017-2320.
What type of attack can be executed using CVE-2017-2320?
CVE-2017-2320 allows for network-based attackers to execute denial of service attacks, leading to various disruptions.
Is authentication required to exploit CVE-2017-2320?
No, CVE-2017-2320 can be exploited by unauthenticated, unprivileged attackers.