CVE-2023-28968 : Security Advisory and Response

This CVE record pertains to an Improperly Controlled Sequential Memory Allocation vulnerability in the Juniper Networks Deep Packet Inspection-Decoder (JDPI-Decoder) Application Signature component of Junos OS's AppID service on SRX Series devices. This vulnerability enables an unauthenticated network-based attacker to bypass JDPI-Decoder actions and pass traffic through the device.

Understanding CVE-2023-28968

This section will delve into the details of CVE-2023-28968, including its impact, technical aspects, affected systems, and mitigation strategies.

What is CVE-2023-28968?

CVE-2023-28968 is an Improperly Controlled Sequential Memory Allocation vulnerability in the JDPI-Decoder Application Signature component of Junos OS's AppID service on SRX Series devices. It affects the JDPI-Decoder Engine and the AppID SigPack and requires both components to be upgraded along with the operating system to address the issue.

The Impact of CVE-2023-28968

This vulnerability allows malicious actors to evade the JDPI-Decoder's dynamic application traffic inspection, leading to traffic being passed through without appropriate action. This flaw jeopardizes the integrity of network security and can potentially enable unauthorized access to sensitive information.

Technical Details of CVE-2023-28968

The technical details of CVE-2023-28968 include a Vulnerability Description, Affected Systems and Versions, and the Exploitation Mechanism.

Vulnerability Description

The vulnerability arises from an Improperly Controlled Sequential Memory Allocation in the JDPI-Decoder Application Signature component, enabling unauthorized traffic to bypass inspection and actions.

Affected Systems and Versions

Various versions of Junos OS on SRX Series devices are impacted, including versions prior to 19.1R3-S10, 19.2R3-S7, 19.3R3-S8, 19.4R3-S11, and subsequent releases up to 22.3R2.

Exploitation Mechanism

The vulnerability can be exploited by sending malicious traffic to the target device using the JDPI-Decoder, causing it to fail to identify dynamic application traffic and execute proper actions.

Mitigation and Prevention

This section focuses on the measures to mitigate and prevent exploitation of CVE-2023-28968, including Immediate Steps to Take, Long-Term Security Practices, and Patching and Updates.

Immediate Steps to Take

As an immediate response, disabling the AppID service can help prevent exploitation of this vulnerability. Additionally, a temporary solution involves rebooting the device until comprehensive updates can be applied.

Long-Term Security Practices

Implementing proper security policies with dynamic application configurations can enhance network security and thwart potential attacks that leverage this vulnerability.

Patching and Updates

Juniper Networks has released software updates to address CVE-2023-28968. Users are advised to upgrade to the fixed versions, such as 19.4R3-S11, 20.2R3-S7, 20.4R3-S6, and subsequent releases. Manual IDP signature updates or enabling automatic updates can also mitigate the risk associated with this vulnerability. Customers are encouraged to follow the provided instructions for secure configuration and maintenance of their devices.