CVE-2017-10604 Juniper JUNOS Denial of Service (account lock out) Vulnerability (JSA10806)

Juniper JUNOS is the network operating system used in Juniper Networks hardware systems.

When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempting to log in as root with an incorrect password can trigger a lockout of the root account. When an SRX Series device is in cluster mode, and a cluster sync or failover operation occurs, then there will be errors associated with synch or failover while the root account is locked out.

Affected Versions:
Junos OS 12.1X46 prior to 12.1X46-D65 on SRX series;
12.3X48 prior to 12.3X48-D45 on SRX series;
15.1X49 prior to 15.1X49-D75 on SRX series

When an SRX Series device is in cluster mode, and a cluster sync or failover operation occurs, then there will be errors associated with synch or failover while the root account is locked out.

The following software releases have been updated to resolve this specific issue: 12.1X46-D65, 12.3X48-D45, 15.1X49-D75, and all subsequent releases.

Workaround:
Administrators may block the offending SSH traffic from an upstream device.
Use access lists or firewall filters to limit access to the device only from trusted administrative hosts, networks and users.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

JSA10806: junos