Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length.

Üreticinin çözüm notu (İngilizce)

The following software releases of Session Smart Router have been updated to resolve these specific issues:
* 7.0.5

and all subsequent releases;
* 7.1.7

and all subsequent releases;
* 7.2.3 and all subsequent releases.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• supportportal.juniper.net/JSA112183 Üretici bülteni

Kayıt geçmişi

1. 28 Eki 2026 19:33Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-106079Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration
• 7,1 CVE-2026-103411Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing
• 7,5 CVE-2026-103410Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection
• 9,8 CVE-2026-103409Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
• 8,8 CVE-2026-103408Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options
• 8,8 CVE-2026-103407Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management