The following software releases have been updated to resolve this specific issue: 1.1.4 and all subsequent releases. If suspicious or unusual usernames or IP addresses entries are present in the SRX auth table, they need to be removed from the SRX auth table.

This issue applicable only when the Windows Domain Controller's policy is set to audit account logon failures and SRX has any security policies configured with the term "match source-identity authenticated-user".

On the domain controller(s), edit GPO policy for Computer Configuration->Policies->Windows Settings->Security Settings->Local Policies->Audit Policy. Uncheck "Failure" for "Audit account logon events". This option is unchecked by default. In the cmd prompt, enter "gpupdate /force" to immediately update the policy change.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability. If the issue is being exploited to bypass SRX firewall policies, suspicious or unusual usernames or IP addresses entries may be present in the SRX auth table.