CVE-2017-2324 Command injection in NorthStar Controller Application
A command injection flaw in Juniper NorthStar Controller allows remote attackers to cause a denial of service condition.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-2324?
CVE-2017-2324 is a medium-severity command injection vulnerability in Juniper Networks NorthStar Controller Application, published on 24 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A command injection vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to cause a denial of service condition.
Weakness: CWE-77
Which versions are affected by CVE-2017-2324?
It affects 1 product.
Products include Juniper Northstar Controller.
How do I fix CVE-2017-2324?
No fix has been published for CVE-2017-2324 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-2324 being exploited?
There is no known exploitation of CVE-2017-2324 in the wild and no public exploit code.
Other vulnerabilities in Juniper Networks NorthStar Controller Application
- CVE-2017-2320 Information disclosure in NorthStar Controller Application
- CVE-2017-2332 Auth bypass in NorthStar Controller Application
- CVE-2017-2317 Denial of service in NorthStar Controller Application
- CVE-2017-2321 Other in NorthStar Controller Application
- CVE-2017-2319 Auth bypass in NorthStar Controller Application
Sources
Also known as GHSA-c6g8-r8m6-hpwp.