Juniper SRX/J-Series DNS Proxy CVE-2015-5477 Vulnerability Advisory

Vulnerability Key Information CVE ID: CVE-2015-5477 Affected Products: SRX-Series and J-Series devices configured with DNS Proxy service Severity: Medium (5.3) Description: A vulnerability exists in ISC BIND when processing TKEY record queries, which could allow a remote attacker to terminate the process via an assertion failure. Currently, Juniper SIRT has not observed any malicious exploitation on Junos devices, but public proof-of-concept (PoC) exploits are known to exist. Resolution: This issue has been fixed in the following Junos OS versions: 12.1X44-D55, 12.1X46-D40, 12.1X46-D45, 12.1X47-D30, 12.3R11, 12.3R12, 12.3X48-D20, 12.3X50-D50, 13.2R9, 13.2X51-D39, 13.2X51-D40, 13.3R8, 14.1R6, 14.1R7, 14.1X53-D30, 14.2R5, 15.1F3, 15.1R2, 15.1R3, 15.1X49-D30, 15.1X53-D20, 15.2R1 and later versions. Workarounds: - Disable DNS proxy service: - Use firewall filters to restrict DNS queries on TCP and UDP port 53. - Use a non-BIND-based DNS server. - Restrict access to critical infrastructure network devices. Related Links: - KB16613: Overview of Juniper Networks SIRT Security Bulletin Release Process - KB16765: Which Patch Versions Fix the Vulnerability? - KB16446: CVSS and Juniper Security Recommendations - Report a Security Vulnerability - Contact Juniper Network Security Incident Response Team - ISC BIND: BIND Assertion Failure - ISC BIND: CVE-2015-5477

Goal Reached Thanks to every supporter — we hit 100%!

Juniper SRX/J-Series DNS Proxy CVE-2015-5477 Vulnerability Advisory