Support Support Downloads Knowledge Base Service Request Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[SRX] Pulse Secure client privilege escalation issue (CVE-2016-2408)

0

0

Article ID: TSB16966 TECHNICAL_BULLETINS Last Updated: 14 Mar 2017Version: 2.0
Alert Type:
PSN - Product Support Notification
Product Affected:
Pulse Secure client for Windows
Alert Description:
The SRX dynamic VPN feature works in conjunction with the Pulse Secure VPN client, simplifying remote access Internet Protocol Security (IPsec) VPN tunnels.

Pulse Secure LLC, recently issued security advisory SA40241 (CVE-2016-2408) for Pulse Secure products.  Item #1 of the Security Advisory, relating to Pulse Secure (Windows) Desktop clients, is the only area of relevance relating to SRX VPN connections.

By exploiting this client side vulnerability, a restricted user on a Windows endpoint machine can obtain administrative privilege.  This is a client-side exploit only and does not affect the SRX devices or IPsec connections to SRX devices.

 
Solution:
SRX customers using Pulse Secure (Windows) Desktop client with versions below 5.1R9.1 are recommended to upgrade client software to 5.1R9.1.
Note: Macintosh image is provided below, however the exploit is not known to impact Macintosh systems
 
 
To verify Windows based Pulse Secure client version in use:
  • Right click Pulse icon in task bar
  • Select Open Pulse / Open Pulse Secure
  • Click Help tab
  • Click on About



Windows 32bit installer Windows 64bit installer
Macintosh

Pulse Secure 5.1R9.1 Release Notes
 

Pulse Secure Supported Platforms Guide
 

Related Links

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Security Alerts and Vulnerabilities

Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search