CVE-2015-5361
Summary
| CVE | CVE-2015-5361 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-02-28 23:15:00 UTC |
| Updated | 2023-11-07 02:26:00 UTC |
| Description | Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the FTP data channel. These related sessions (gates) are specific to source and destination IPs and ports of client and server. The design intent of the ftps-extensions option (which is disabled by default) is to provide similar functionality when the SRX secures the FTP/FTPS client. As the control channel is encrypted, the FTP ALG cannot inspect the port specific information and will open a wider TCP data channel (gate) from client IP to server IP on all destination TCP ports. In FTP/FTPS client environments to an enterprise network or the Internet, this is the desired behavior as it allows firewall policy to be written to FTP/FTPS servers on well-known control ports without using a policy with destination IP ANY and destination port ANY. Issue The ftps-extensions option is not intended or recommended where the SRX secures the FTPS server, as the wide data channel session (gate) will allow the FTPS client temporary access to all TCP ports on the FTPS server. The data session is associated to the control channel and will be closed when the control channel session closes. Depending on the configuration of the FTPS server, supporting load-balancer, and SRX inactivity-timeout values, the server/load-balancer and SRX may keep the control channel open for an extended period of time, allowing an FTPS client access for an equal duration. Note that the ftps-extensions option is not enabled by default. |
Risk And Classification
Problem Types: CWE-326
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Juniper | Junos | 12.1x44 | - | All | All |
| Operating System | Juniper | Junos | 12.1x44 | d10 | All | All |
| Operating System | Juniper | Junos | 12.1x44 | d15 | All | All |
| Operating System | Juniper | Junos | 12.1x44 | d20 | All | All |
| Operating System | Juniper | Junos | 12.1x44 | d25 | All | All |
| Operating System | Juniper | Junos | 12.1x44 | d30 | All | All |
| Operating System | Juniper | Junos | 12.1x44 | d35 | All | All |
| Operating System | Juniper | Junos | 12.1x44 | d40 | All | All |
| Operating System | Juniper | Junos | 12.1x44 | d45 | All | All |
| Operating System | Juniper | Junos | 12.1x44 | d50 | All | All |
| Operating System | Juniper | Junos | 12.1x46 | - | All | All |
| Operating System | Juniper | Junos | 12.1x46 | d10 | All | All |
| Operating System | Juniper | Junos | 12.1x46 | d15 | All | All |
| Operating System | Juniper | Junos | 12.1x46 | d20 | All | All |
| Operating System | Juniper | Junos | 12.1x46 | d25 | All | All |
| Operating System | Juniper | Junos | 12.1x46 | d30 | All | All |
| Operating System | Juniper | Junos | 12.1x46 | d35 | All | All |
| Operating System | Juniper | Junos | 12.1x46-d10 | All | All | All |
| Operating System | Juniper | Junos | 12.1x47 | - | All | All |
| Operating System | Juniper | Junos | 12.1x47 | d10 | All | All |
| Operating System | Juniper | Junos | 12.1x47 | d15 | All | All |
| Operating System | Juniper | Junos | 12.1x47 | d20 | All | All |
| Operating System | Juniper | Junos | 12.3x48 | - | All | All |
| Operating System | Juniper | Junos | 12.3x48 | d10 | All | All |
| Operating System | Juniper | Junos | 12.3x48 | d15 | All | All |
| Operating System | Juniper | Junos | 15.1x49 | - | All | All |
| Hardware | Juniper | Srx100 | - | All | All | All |
| Hardware | Juniper | Srx110 | - | All | All | All |
| Hardware | Juniper | Srx1400 | - | All | All | All |
| Hardware | Juniper | Srx1500 | - | All | All | All |
| Hardware | Juniper | Srx1500 | - | All | All | All |
| Operating System | Juniper | Srx1500 Firmware | - | All | All | All |
| Operating System | Juniper | Srx1500 Firmware | - | All | All | All |
| Hardware | Juniper | Srx210 | - | All | All | All |
| Hardware | Juniper | Srx220 | - | All | All | All |
| Hardware | Juniper | Srx240 | - | All | All | All |
| Hardware | Juniper | Srx240h2 | - | All | All | All |
| Hardware | Juniper | Srx300 | - | All | All | All |
| Hardware | Juniper | Srx300 | - | All | All | All |
| Operating System | Juniper | Srx300 Firmware | - | All | All | All |
| Operating System | Juniper | Srx300 Firmware | - | All | All | All |
| Hardware | Juniper | Srx320 | - | All | All | All |
| Hardware | Juniper | Srx340 | - | All | All | All |
| Hardware | Juniper | Srx3400 | - | All | All | All |
| Hardware | Juniper | Srx345 | - | All | All | All |
| Hardware | Juniper | Srx3600 | - | All | All | All |
| Hardware | Juniper | Srx380 | - | All | All | All |
| Hardware | Juniper | Srx4000 | - | All | All | All |
| Hardware | Juniper | Srx4100 | - | All | All | All |
| Hardware | Juniper | Srx4100 | - | All | All | All |
| Operating System | Juniper | Srx4100 Firmware | - | All | All | All |
| Operating System | Juniper | Srx4100 Firmware | - | All | All | All |
| Hardware | Juniper | Srx4200 | - | All | All | All |
| Hardware | Juniper | Srx4200 | - | All | All | All |
| Operating System | Juniper | Srx4200 Firmware | - | All | All | All |
| Operating System | Juniper | Srx4200 Firmware | - | All | All | All |
| Hardware | Juniper | Srx4600 | - | All | All | All |
| Hardware | Juniper | Srx4600 | - | All | All | All |
| Operating System | Juniper | Srx4600 Firmware | - | All | All | All |
| Operating System | Juniper | Srx4600 Firmware | - | All | All | All |
| Hardware | Juniper | Srx5000 | - | All | All | All |
| Hardware | Juniper | Srx5400 | - | All | All | All |
| Hardware | Juniper | Srx5400 | - | All | All | All |
| Operating System | Juniper | Srx5400 Firmware | - | All | All | All |
| Operating System | Juniper | Srx5400 Firmware | - | All | All | All |
| Hardware | Juniper | Srx550 | - | All | All | All |
| Hardware | Juniper | Srx550 | - | All | All | All |
| Hardware | Juniper | Srx550m | - | All | All | All |
| Operating System | Juniper | Srx550 Firmware | - | All | All | All |
| Operating System | Juniper | Srx550 Firmware | - | All | All | All |
| Hardware | Juniper | Srx550 Hm | - | All | All | All |
| Hardware | Juniper | Srx5600 | - | All | All | All |
| Hardware | Juniper | Srx5600 | - | All | All | All |
| Operating System | Juniper | Srx5600 Firmware | - | All | All | All |
| Operating System | Juniper | Srx5600 Firmware | - | All | All | All |
| Hardware | Juniper | Srx5800 | - | All | All | All |
| Hardware | Juniper | Srx5800 | - | All | All | All |
| Operating System | Juniper | Srx5800 Firmware | - | All | All | All |
| Operating System | Juniper | Srx5800 Firmware | - | All | All | All |
| Hardware | Juniper | Srx650 | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 2015-10 Security Bulletin: Junos: FTPS through SRX opens up wide range of data channel TCP ports (CVE-2015-5361) - Juniper Networks | CONFIRM | kb.juniper.net | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.