CVE-2018-0024 — HIGH (7.8) — White Hats Nepal

Vulnerability Description

An Improper Privilege Management vulnerability in a shell session of Juniper Networks Junos OS allows an authenticated unprivileged attacker to gain full control of the system. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D45 on SRX Series; 12.3X48 versions prior to 12.3X48-D20 on SRX Series; 12.3 versions prior to 12.3R11 on EX Series; 14.1X53 versions prior to 14.1X53-D30 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100;; 15.1X49 versions prior to 15.1X49-D20 on SRX Series.

CVSS Score

7.8

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Juniper	Junos	12.1x46
Juniper	Srx100	-
Juniper	Srx110	-
Juniper	Srx1400	-
Juniper	Srx1500	-
Juniper	Srx210	-
Juniper	Srx220	-
Juniper	Srx240	-
Juniper	Srx300	-
Juniper	Srx320	-
Juniper	Srx340	-
Juniper	Srx3400	-
Juniper	Srx345	-
Juniper	Srx3600	-
Juniper	Srx4100	-
Juniper	Srx4200	-
Juniper	Srx5400	-
Juniper	Srx550	-
Juniper	Srx5600	-
Juniper	Srx5800	-

Related Weaknesses (CWE)

CWE-269

References

http://www.securityfocus.com/bid/104718Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041314Third Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10857MitigationVendor Advisory
http://www.securityfocus.com/bid/104718Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041314Third Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10857MitigationVendor Advisory

FAQ

What is CVE-2018-0024?

CVE-2018-0024 is a vulnerability with a CVSS score of 7.8 (HIGH). An Improper Privilege Management vulnerability in a shell session of Juniper Networks Junos OS allows an authenticated unprivileged attacker to gain full control of the system. Affected releases are J...

How severe is CVE-2018-0024?

CVE-2018-0024 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-0024?

Check the references section above for vendor advisories and patch information. Affected products include: Juniper Junos, Juniper Srx100, Juniper Srx110, Juniper Srx1400, Juniper Srx1500.