XML entity injection vulnerability may allow unprivileged users to cause a denial of service condition.
In addition to the above a vulnerability in Apache Commons Collections that can potentially allow remote code execution during object de-serialization is fixed by upgrading Apache Commons Collections to 3.2.2. This vulnerability is not exposed and is not exploitable on Junos Space, however the underlaying library is upgraded to eliminate all risks.
Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.
Many of these issues were found during internal product testing.
These issues have been resolved in Junos Space 15.2R2 and all subsequent releases.
These issues are being tracked as 954495, 975358, 975426, 975445, 975447, 975457, 975466, 975472, 975473, 975474, 975491, 975502, 975506, 975509, 975510, 975516, 975518, 975530, 975534, 983931, 983945, 983960, 983964, 1049736, 1049737, 1105605, 1138099, 1164153, 1165549 and are visible on the Customer Support website.
Limit access to Junos Space from only trusted networks.
Use administrative jump boxes with no internet access and employ anti-scripting techniques.
In addition to the recommendations listed above, it is good security practice to limit the exploitable attack surface of critical infrastructure networking equipment. Use access lists or firewall filters to limit access to the devices administrative interfaces only from trusted, administrative networks or hosts.
How to obtain fixed software: Junos Space Maintenance Releases are available at http://support.juniper.net from the "Download Software" links. If a Maintenance Release is not adequate and access to Junos Space patches is needed, open a customer support case. A JTAC engineer will review your request and respond, ensuring that you will be provided with the most appropriate Patch Release for your specific situation.