CVE-2017-10604 : When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempt

When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempting to log in as root with an incorrect password can trigger a lockout of the root account. When an SRX Series device is in cluster mode, and a cluster sync or failover operation occurs, then there will be errors associated with synch or failover while the root account is locked out. Administrators can confirm if the root account is locked out via the following command root@device> show system login lockout user root User Lockout start Lockout end root 1995-01-01 01:00:01 PDT 1995-11-01 01:31:01 PDT Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D65 on SRX series; 12.3X48 prior to 12.3X48-D45 on SRX series; 15.1X49 prior to 15.1X49-D75 on SRX series.

Published 2017-07-17 13:18:19

Updated 2019-10-09 23:21:39

Source Juniper Networks, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2017-10604

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 35 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-10604

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	Juniper Networks, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2017-10604

CWE-307 Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-10604

http://www.securitytracker.com/id/1038886

Juniper Junos SRX Series Cluster Mode Account Lockout Bug Lets Remote Users Deny Service - SecurityTracker
Third Party Advisory;VDB Entry
https://kb.juniper.net/JSA10806

Juniper Networks - 2017-07 Security Bulletin: Junos OS: SRX Series: Cluster configuration synch failures occur if the root user account is locked out (CVE-2017-10604)
Vendor Advisory

Products affected by CVE-2017-10604

Juniper » Junos » Version: 12.1x46
cpe:2.3:o:juniper:junos:12.1x46:*:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.1x46 Update D10
cpe:2.3:o:juniper:junos:12.1x46:d10:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.1x46 Update D20
cpe:2.3:o:juniper:junos:12.1x46:d20:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.1x46 Update D15
cpe:2.3:o:juniper:junos:12.1x46:d15:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.3x48
cpe:2.3:o:juniper:junos:12.3x48:*:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.1x46 Update D25
cpe:2.3:o:juniper:junos:12.1x46:d25:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.1x46 Update D30
cpe:2.3:o:juniper:junos:12.1x46:d30:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.3x48 Update D10
cpe:2.3:o:juniper:junos:12.3x48:d10:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49
cpe:2.3:o:juniper:junos:15.1x49:*:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49 Update D10
cpe:2.3:o:juniper:junos:15.1x49:d10:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49 Update D20
cpe:2.3:o:juniper:junos:15.1x49:d20:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.1x46 Update D50
cpe:2.3:o:juniper:junos:12.1x46:d50:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.3x48 Update D15
cpe:2.3:o:juniper:junos:12.3x48:d15:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.1x46 Update D35
cpe:2.3:o:juniper:junos:12.1x46:d35:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.1x46 Update D40
cpe:2.3:o:juniper:junos:12.1x46:d40:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49 Update D30
cpe:2.3:o:juniper:junos:15.1x49:d30:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49 Update D35
cpe:2.3:o:juniper:junos:15.1x49:d35:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.1x46 Update D45
cpe:2.3:o:juniper:junos:12.1x46:d45:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.3x48 Update D25
cpe:2.3:o:juniper:junos:12.3x48:d25:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.3x48 Update D20
cpe:2.3:o:juniper:junos:12.3x48:d20:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.1x46 Update D55
cpe:2.3:o:juniper:junos:12.1x46:d55:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.3x48 Update D30
cpe:2.3:o:juniper:junos:12.3x48:d30:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49 Update D45
cpe:2.3:o:juniper:junos:15.1x49:d45:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49 Update D50
cpe:2.3:o:juniper:junos:15.1x49:d50:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49 Update D55
cpe:2.3:o:juniper:junos:15.1x49:d55:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49 Update D40
cpe:2.3:o:juniper:junos:15.1x49:d40:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.3x48 Update D40
cpe:2.3:o:juniper:junos:12.3x48:d40:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 12.3x48 Update D35
cpe:2.3:o:juniper:junos:12.3x48:d35:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49 Update D65
cpe:2.3:o:juniper:junos:15.1x49:d65:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49 Update D60
cpe:2.3:o:juniper:junos:15.1x49:d60:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A
Juniper » Junos » Version: 15.1x49 Update D70
cpe:2.3:o:juniper:junos:15.1x49:d70:*:*:*:*:*:*
Matching versions
When used together with: Juniper » SRX » Version: N/A

Vulnerability Details : CVE-2017-10604

Exploit prediction scoring system (EPSS) score for CVE-2017-10604

CVSS scores for CVE-2017-10604

CWE ids for CVE-2017-10604

References for CVE-2017-10604

Products affected by CVE-2017-10604