CVSS: 9.8EPSS: 6%CPEs: 67EXPL: 0CVE-2018-0001 – Junos: Unauthenticated Remote Code Execution through J-Web interface
https://notcve.org/view.php?id=CVE-2018-0001
A remote, unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific PHP URLs within the context of the J-Web process. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D67; 12.3 versions prior to 12.3R12-S5; 12.3X48 versions prior to 12.3X48-D35; 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D44, 14.1X53-D50; 14.2 versions prior to 14.2R7-S7, 14.2R8; 15.1 versions prior to 15.1R3; 15.1X49 versions prior to 15.1X49-D30; 15.1X53 versions prior to 15.1X53-D70. Un atacante remoto no autenticado podría ejecutar código explotando un defecto de uso de memoria previamente liberada en versiones antiguas de PHP mediante la inyección de datos manipulados a través de URL PHP específicas en el contexto del proceso J-Web. Las distribuciones afectadas son Juniper Networks Junos OS: 12.1X46 anterior a 12.1X46-D67; 12.3 anterior a 12.3R12-S5; 12.3X48 anterior a 12.3X48-D35; 14.1 anterior a 14.1R8-S5, 14.1R9; 14.1X53 anterior a 14.1X53-D44, 14.1X53-D50; 14.2 anterior a 14.2R7-S7, 14.2R8; 15.1 anterior a 15.1R3; 15.1X49 anterior a 15.1X49-D30; 15.1X53 anterior a 15.1X53-D70. • http://www.securityfocus.com/bid/103092 http://www.securitytracker.com/id/1040180 https://kb.juniper.net/JSA10828 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 18EXPL: 0CVE-2018-0006 – Junos OS: bbe-smgd process denial of service while processing VLAN authentication requests/rejects
https://notcve.org/view.php?id=CVE-2018-0006
A high rate of VLAN authentication attempts sent from an adjacent host on the local broadcast domain can trigger high memory utilization by the BBE subscriber management daemon (bbe-smgd), and lead to a denial of service condition. The issue was caused by attempting to process an unbounded number of pending VLAN authentication requests, leading to excessive memory allocation. This issue only affects devices configured for DHCPv4/v6 over AE auto-sensed VLANs, utilized in Broadband Edge (BBE) deployments. Other configurations are unaffected by this issue. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1R6-S2, 15.1R7; 16.1 versions prior to 16.1R5-S1, 16.1R6; 16.2 versions prior to 16.2R2-S2, 16.2R3; 17.1 versions prior to 17.1R2-S5, 17.1R3; 17.2 versions prior to 17.2R2. • http://www.securitytracker.com/id/1040184 https://kb.juniper.net/JSA10834 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 102EXPL: 0CVE-2018-0003 – Junos OS: A crafted MPLS packet may lead to a kernel crash
https://notcve.org/view.php?id=CVE-2018-0003
A specially crafted MPLS packet received or processed by the system, on an interface configured with MPLS, will store information in the system memory. Subsequently, if this stored information is accessed, this may result in a kernel crash leading to a denial of service. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D71; 12.3 versions prior to 12.3R12-S7; 12.3X48 versions prior to 12.3X48-D55; 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D45, 14.1X53-D107; 14.2 versions prior to 14.2R7-S7, 14.2R8; 15.1 versions prior to 15.1F5-S8, 15.1F6-S8, 15.1R5-S6, 15.1R6-S3, 15.1R7; 15.1X49 versions prior to 15.1X49-D100; 15.1X53 versions prior to 15.1X53-D65, 15.1X53-D231; 16.1 versions prior to 16.1R3-S6, 16.1R4-S6, 16.1R5; 16.1X65 versions prior to 16.1X65-D45; 16.2 versions prior to 16.2R2-S1, 16.2R3; 17.1 versions prior to 17.1R2-S2, 17.1R3; 17.2 versions prior to 17.2R1-S3, 17.2R2; 17.2X75 versions prior to 17.2X75-D50. No other Juniper Networks products or platforms are affected by this issue. Un paquete MPLS especialmente manipulado recibido o procesado por el sistema en una interfaz configurada con MPLS almacenará información en la memoria del sistema. • http://www.securityfocus.com/bid/105715 http://www.securitytracker.com/id/1040179 https://kb.juniper.net/JSA10831 •
CVSS: 10.0EPSS: 0%CPEs: 102EXPL: 0CVE-2018-0007
https://notcve.org/view.php?id=CVE-2018-0007
An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to the local segment, through a local segment broadcast, may be able to cause a Junos device to enter an improper boundary check condition allowing a memory corruption to occur, leading to a denial of service. Further crafted packets may be able to sustain the denial of service condition. Score: 6.5 MEDIUM (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Further, if the attacker is authenticated on the target device receiving and processing the malicious LLDP packet, while receiving the crafted packets, the attacker may be able to perform command or arbitrary code injection over the target device thereby elevating their permissions and privileges, and taking control of the device. Score: 7.8 HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to one or more local segments, via LLDP proxy / tunneling agents or other LLDP through Layer 3 deployments, through one or more local segment broadcasts, may be able to cause multiple Junos devices to enter an improper boundary check condition allowing a memory corruption to occur, leading to multiple distributed Denials of Services. These Denials of Services attacks may have cascading Denials of Services to adjacent connected devices, impacts network devices, servers, workstations, etc. • http://www.securitytracker.com/id/1040181 https://kb.juniper.net/JSA10830 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.2EPSS: 0%CPEs: 176EXPL: 0CVE-2018-0002 – MX series, SRX series: Junos OS: Denial of service vulnerability in Flowd on devices with ALG enabled.
https://notcve.org/view.php?id=CVE-2018-0002
On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashes of the flowd daemon which results in an extended Denial of Service condition. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D60 on SRX series; 12.3X48 versions prior to 12.3X48-D35 on SRX series; 14.1 versions prior to 14.1R9 on MX series; 14.2 versions prior to 14.2R8 on MX series; 15.1X49 versions prior to 15.1X49-D60 on SRX series; 15.1 versions prior to 15.1R5-S8, 15.1F6-S9, 15.1R6-S4, 15.1R7 on MX series; 16.1 versions prior to 16.1R6 on MX series; 16.2 versions prior to 16.2R3 on MX series; 17.1 versions prior to 17.1R2-S4, 17.1R3 on MX series. No other Juniper Networks products or platforms are affected by this issue. En dispositivos de las series SRX y MX con un Service PIC con cualquier ALG habilitado, un paquete de respuesta TCP/IP manipulado procesado por el dispositivo resulta en una corrupción de memoria que provoca que el demonio flowd se cierre de manera inesperada. • http://www.securitytracker.com/id/1040178 https://kb.juniper.net/JSA10829 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •