Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

An Out-of-Bounds Write vulnerability in the TCP header processing in Juniper Networks Session Smart Router allows an attacker to corrupt TCP payload data and potentially cause session desynchronization via a transit TCP packet with an oversized SACK option length.

Üreticinin çözüm notu (İngilizce)

The following software releases of Session Smart Router have been updated to resolve these specific issues:
* 7.0.5

and all subsequent releases;
* 7.1.7

and all subsequent releases;
* 7.2.3 and all subsequent releases.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• supportportal.juniper.net/JSA112183 Üretici bülteni

Kayıt geçmişi

1. 28 Eki 2026 19:33Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-106079Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration
• 7,1 CVE-2026-103411Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing
• 7,5 CVE-2026-103410Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection
• 9,8 CVE-2026-103409Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
• 8,8 CVE-2026-103408Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options
• 8,8 CVE-2026-103407Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management