Juniper QFX3500 and QFX3600 switches CVE-2015-3006 Insufficient Entropy Vulnerability

Bugtraq ID:	74020
Class:	Design Error
CVE:	CVE-2015-3006
Remote:	Yes
Local:	No
Published:	Apr 09 2015 12:00AM
Updated:	Apr 09 2015 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Juniper QFX3600 0 Juniper QFX3500 0 Juniper Junos 14.1X50-D70 Juniper Junos 13.2X51-D20 Juniper Junos 13.2X51-D15 Juniper Junos 13.2X50-D20 Juniper Junos 13.2X50-D15.3 Juniper Junos 13.1X49-D55 Juniper Junos 13.1X49-D49 Juniper Junos 12.2X50-D50.1 Juniper Junos 12.2X50-D40.5 Juniper Junos 12.2X50-D20.4
Not Vulnerable:	Juniper Junos 14.1X53-D10 Juniper Junos 13.2X52-D15 Juniper Junos 13.2X51-D30 Juniper Junos 13.2X51-D25 Juniper Junos 13.1X50-D30 Juniper Junos 12.2X50-D70

Juniper QFX3500 and QFX3600 switches CVE-2015-3006 Insufficient Entropy Vulnerability

Juniper QFX3500 and QFX3600 switches are prone to an insufficient-entropy vulnerability.

Remote attackers can exploit this issue to perform man-in-the-middle attacks and obtain sensitive information. This aids in other attacks. This could allow the attacker to gain unauthorized access to the system.

Juniper QFX3500 and QFX3600 switches CVE-2015-3006 Insufficient Entropy Vulnerability

Attackers can use readily available tools to exploit this issue.

Juniper QFX3500 and QFX3600 switches CVE-2015-3006 Insufficient Entropy Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Juniper QFX3500 and QFX3600 switches CVE-2015-3006 Insufficient Entropy Vulnerability

References:

• Juniper HomePage (Juniper)
  
• 2015-04 Security Bulletin: Junos: Insufficient entropy on QFX3500 and QFX3600 pl (Juniper)