Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.

Summary

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

Remediation

1. Inventory every Juniper Networks Session Smart Conductor deployment, including staging.
2. Upgrade Juniper Networks Session Smart Conductor to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://supportportal.juniper.net/JSA112183