In order to resolve this issue (remove the ONIE partition from the device), customer needs to reimage the device using the USB or PXE image from the Juniper download page. The affected Junos image files have been removed from the Juniper download page.

Customer can identify whether their device is affected by running the following commands from the Junos OS shell: Affected System : root@:RE:0% rsh -l root -JU __juniper_private4__ 192.168.1.1 root@:RE:0~# grub-fstest /dev/sda2 ls /var/tmp /onie/ | grep onie vmlinuz-3.2.35-onie initrd.img-3.2.35-onie tools/ grub/ grub.d/ root@:RE:0:~# Note: the two files, vmlinuz-3.2.35-onie and initrd.img-3.2.35-onie (version may vary) will be present. Non-affected System: root@:RE:0% rsh -l root -JU __juniper_private4__ 192.168.1.1 root@local-node:~# grub-fstest /dev/sda2 ls /onie/ | grep onie root@local-node:~# Note: no grep output related to ONIE partition.

There are no known workarounds for this issue. It is good security practice to limit the exploitable attack surface of critical infrastructure networking equipment. Use access lists or firewall filters to limit access to device only from trusted, administrative networks or hosts. Limit CLI access to the device from only trusted hosts and administrators.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.