The Cybersecurity and Infrastructure Security Agency has issued a warning urging organizations to immediately patch critical vulnerabilities impacting Juniper Networks' Junos Space, NorthStar Controller, and Contrail Networking offerings even though Juniper has not found any evidence of active exploitation, according to The Register.
"CISA encourages users and administrators to review the Juniper Networks security advisories pageand apply the necessary updates," said CISA in its advisory.
Thirty-one vulnerabilities in Junos Space affect OpenSSH, Oracle Java SE, Samba, nginx resolver, Kerberos, curl, MySQL Server, OpenSSL, and the RPM package manager, with the one in the nginx resolver, tracked as CVE-2021-23017, potentially exploitable to enable system crashes.
Such a flaw "might allow an attacker who is able to forge UDP packets from the DNS server to cause one-byte memory overwrite, resulting in worker process crash or potential other impact," noted Juniper.
In addition, more than 100 CVEs in Contrail Networking dating back to nearly ten years ago have been remediated.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.