CVE-2015-5361
Junos: FTPS through SRX opens up wide range of data channel TCP ports
02 Description
Junos: FTPS through SRX opens up wide range of data channel TCP ports
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.47% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 40.8% of scored records. A rank, not a probability.
- NVD base score
- 6.5 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2020-02-28 22:25Z6 YR AGO
- Last updated
- 2024-09-16 16:39Z2 YR AGO
- Reserved
- 2015-07-01
- Assigning CNA
- mitre
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 6.5)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-326Inadequate Encryption StrengthClass
- Data version
- 5.1
- Document digest
- 7ea817f14430bfc6ecb38e33bf1b960012ee5c0b18ab0fe4305ae61790c5fefa
05 Affected products
06 References
- kb.juniper.nethttps://kb.juniper.net/JSA10706
07 Remediation
The overall behavior of the FTP ALG with the ftps-extensions option is intended behavior and will not change. The key component to this advisory is increasing user awareness of the wide TCP data channel (gate) creation, allowing creation of any new sessions from client to server, and potential implications where the SRX protects the FTPS server and the server/load-balancer allows the control channel to remain open for an extended period. Investigation into the issue identified two issues applicable to environments where the SRX protects both FTPS clients and servers, as well as uses FTP and FTPS over the same TCP ports to different servers. Due to the recent changes of OpenSSL, the FTP ALG without the ftps-extensions option may block FTPS commands over the FTP control channel. This is client and server specific, and was observed with FTPS clients that use recent versions of OpenSSL. This may result in security administrators enabling the ftps-extensions option with the intent of allowing the commands to pass, but inadvertently allowing wide gate creation. This was observed in a configuration with simultaneous FTPS client/server use, with use of the same ports for FTP and FTPS traffic. The ftps-extension option is not supported when the SRX performs a destination NAT of the FTPS server, as the ALG cannot inspect the control channel to modify the server’s IP address signaled to the client. In an environment of simultaneous FTP and FTPS server use with the ftps-extensions
The following software releases have been updated to resolve these specific issues: Junos OS 12.1X44-D55, 12.1X46-D40, 12.1X47-D25, 12.3X48-D15, 15.1X49-D10, and all subsequent releases.