{"id":885828,"date":"2023-08-19T06:19:41","date_gmt":"2023-08-19T08:19:41","guid":{"rendered":"https:\/\/teknomers.com\/fr\/les-nouvelles-failles-du-systeme-dexploitation-juniper-junos-exposent-les-appareils-aux-attaques-a-distance-corrigez-maintenant\/"},"modified":"2023-08-19T06:19:44","modified_gmt":"2023-08-19T08:19:44","slug":"les-nouvelles-failles-du-systeme-dexploitation-juniper-junos-exposent-les-appareils-aux-attaques-a-distance-corrigez-maintenant","status":"publish","type":"post","link":"https:\/\/teknomers.com\/fr\/les-nouvelles-failles-du-systeme-dexploitation-juniper-junos-exposent-les-appareils-aux-attaques-a-distance-corrigez-maintenant\/","title":{"rendered":"Les nouvelles failles du syst\u00e8me d&#8217;exploitation Juniper Junos exposent les appareils aux attaques \u00e0 distance &#8211; Corrigez maintenant"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">19 ao\u00fbt 2023<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">THN<\/span><\/span><span class=\"p-tags\">S\u00e9curit\u00e9 r\u00e9seau \/ Vuln\u00e9rabilit\u00e9<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><\/div>\n<p>La soci\u00e9t\u00e9 de mat\u00e9riel r\u00e9seau Juniper Networks a publi\u00e9 une mise \u00e0 jour de s\u00e9curit\u00e9 &#8220;hors cycle&#8221; pour corriger plusieurs failles dans le composant J-Web de Junos OS qui pourraient \u00eatre combin\u00e9es pour permettre l&#8217;ex\u00e9cution de code \u00e0 distance sur des installations sensibles.<\/p>\n<p>Les quatre vuln\u00e9rabilit\u00e9s ont une cote CVSS cumul\u00e9e de 9,8, ce qui les rend critiques en gravit\u00e9.  Ils affectent toutes les versions de Junos OS sur les s\u00e9ries SRX et EX.<\/p>\n<p>&#8220;En encha\u00eenant l&#8217;exploitation de ces vuln\u00e9rabilit\u00e9s, un attaquant non authentifi\u00e9 bas\u00e9 sur le r\u00e9seau peut \u00eatre en mesure d&#8217;ex\u00e9cuter du code \u00e0 distance sur les appareils&#8221;, a d\u00e9clar\u00e9 la soci\u00e9t\u00e9. <a rel=\"nofollow noopener\" href=\"https:\/\/www.juniper.net\/documentation\/us\/en\/software\/jweb-ex\/jweb-ex-application-package\/topics\/concept\/ex-series-j-web-interface-overview-App.html\" target=\"_blank\">dit<\/a> dans un avis publi\u00e9 le 17 ao\u00fbt 2023.<\/p>\n<section class=\"check_two clear badbox\"><center class=\"cf\"><a rel=\"nofollow noopener\" href=\"https:\/\/thn.news\/edWGl41h\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"La cyber-s\u00e9curit\u00e9\" src=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2023\/08\/Microsoft-Exposes-Russian-Hackers039-Sneaky-Phishing-Tactics-via-Microsoft-Teams.png\" width=\"728\" height=\"90\"\/><\/a><\/center><\/section>\n<p>L&#8217;interface J-Web permet aux utilisateurs de configurer, g\u00e9rer et surveiller les appareils Junos OS.  Une br\u00e8ve description des d\u00e9fauts est la suivante &#8211;<\/p>\n<ul>\n<li><a rel=\"nofollow noopener\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-36844\" target=\"_blank\"><strong>CVE-2023-36844<\/strong><\/a>  et <a rel=\"nofollow noopener\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-36845\" target=\"_blank\"><strong>CVE-2023-36845<\/strong><\/a>  (Scores CVSS : 5,3) &#8211; Deux vuln\u00e9rabilit\u00e9s de modification de variables externes PHP dans J-Web de Juniper Networks Junos OS sur EX Series et SRX Series permettent \u00e0 un attaquant r\u00e9seau non authentifi\u00e9 de contr\u00f4ler certaines variables d&#8217;environnement importantes.<\/li>\n<li><a rel=\"nofollow noopener\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-36846\" target=\"_blank\"><strong>CVE-2023-36846<\/strong><\/a>  et <a rel=\"nofollow noopener\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-36847\" target=\"_blank\"><strong>CVE-2023-36847<\/strong><\/a>  (Scores CVSS : 5,3) &#8211; Deux authentifications manquantes pour les vuln\u00e9rabilit\u00e9s de fonction critiques dans Juniper Networks Junos OS sur EX Series et SRX Series permettent \u00e0 un attaquant non authentifi\u00e9 bas\u00e9 sur le r\u00e9seau d&#8217;avoir un impact limit\u00e9 sur l&#8217;int\u00e9grit\u00e9 du syst\u00e8me de fichiers.<\/li>\n<\/ul>\n<p>Un acteur malveillant pourrait envoyer une demande sp\u00e9cialement con\u00e7ue pour modifier certaines variables d&#8217;environnement PHP ou t\u00e9l\u00e9charger des fichiers arbitraires via J-Web sans aucune authentification pour exploiter avec succ\u00e8s les probl\u00e8mes susmentionn\u00e9s.<\/p>\n<section class=\"check_two clear badbox\"><center class=\"cf\"><a rel=\"nofollow noopener\" href=\"https:\/\/thn.news\/Cr7gkMdK\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"La cyber-s\u00e9curit\u00e9\" src=\"https:\/\/thehackernews.com\/new-images\/img\/b\/R29vZ2xl\/AVvXsEgNmNiBV8c8Rp0Xy6N9lCX9JL2cBlrjkSeuW4JhgOVQ3mKTsYV4pPvh3nDz32D97D8XcWQ53EJ1p4n2VX0gZH_YrBZBqElUMfzFWgb50P8lv1iac_1f-p5liZzC1ISVWJygv2s1Qm36rOHwk_kPXUNNT3nbSDr144QYZ6XGq0aXRDOrFfSlUnHnc0x4Fe_F\/s728-e3650\/cis-d.gif\" width=\"728\" height=\"90\"\/><\/a><\/center><\/section>\n<p>Les vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les versions ci-dessous &#8211;<\/p>\n<ul>\n<li><strong>S\u00e9rie EX<\/strong> &#8211; Junos OS versions 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, et 23.2R1<\/li>\n<li><strong>S\u00e9rie SRX<\/strong> &#8211; Junos OS versions 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S5, 22.1R3-S3, 22.2R3-S2, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, et 23.2R1<\/li>\n<\/ul>\n<p>Il est recommand\u00e9 aux utilisateurs d&#8217;appliquer les correctifs n\u00e9cessaires pour att\u00e9nuer les menaces potentielles d&#8217;ex\u00e9cution de code \u00e0 distance.  Comme solution de contournement, Juniper Networks sugg\u00e8re aux utilisateurs de d\u00e9sactiver J-Web ou de limiter l&#8217;acc\u00e8s aux seuls h\u00f4tes de confiance.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Vous avez trouv\u00e9 cet article int\u00e9ressant ?  Suivez-nous sur <a rel=\"nofollow noopener\" href=\"https:\/\/twitter.com\/thehackersnews\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a>  et <a rel=\"nofollow noopener\" href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" target=\"_blank\">LinkedIn<\/a> pour lire plus de contenu exclusif que nous publions.<\/div>\n<\/div>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2023\/08\/new-juniper-junos-os-flaws-expose.html\" rel=\"nofollow noopener\" target=\"_blank\">ttn-fr-57<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue80219 ao\u00fbt 2023\ue804THNS\u00e9curit\u00e9 r\u00e9seau \/ Vuln\u00e9rabilit\u00e9 La soci\u00e9t\u00e9 de mat\u00e9riel r\u00e9seau Juniper Networks a publi\u00e9 une mise \u00e0 jour de s\u00e9curit\u00e9 &#8220;hors cycle&#8221; pour corriger plusieurs failles dans le composant J-Web de Junos OS qui pourraient \u00eatre combin\u00e9es pour permettre l&#8217;ex\u00e9cution de code \u00e0 distance sur des installations sensibles. Les quatre vuln\u00e9rabilit\u00e9s ont une cote [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":885829,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[8737,8074,507,4168,19981,4158,4165,4161,5858,2526,39576,4806,90722,90723,4157,4159,4171,4170,65,4167,617,4160,120,4163,4162,4172,4169,2622,4166,4164],"class_list":["post-885828","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technologie","tag-appareils","tag-attaques","tag-aux","tag-comment-pirater","tag-corrigez","tag-cyber-actualites","tag-cyber-attaques","tag-cyber-mises-a-jour","tag-dexploitation","tag-distance","tag-exposent","tag-failles","tag-juniper","tag-junos","tag-lactualite-de-la-cybersecurite","tag-lactualite-de-la-cybersecurite-aujourdhui","tag-lactualite-des-hackers","tag-la-securite-des-informations","tag-les","tag-logiciel-malveillant-de-ransomware","tag-maintenant","tag-mises-a-jour-de-la-cybersecurite","tag-nouvelles","tag-nouvelles-de-piratage","tag-nouvelles-de-pirates","tag-securite-informatique","tag-securite-internet","tag-systeme","tag-violation-de-donnees","tag-vulnerabilite-logicielle"],"_links":{"self":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/885828","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/comments?post=885828"}],"version-history":[{"count":0,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/885828\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media\/885829"}],"wp:attachment":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media?parent=885828"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/categories?post=885828"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/tags?post=885828"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}