CVE-2018-0001 Junos: Unauthenticated Remote Code Execution through J-Web interface
CriticalCVSS 9.8
EPSS 6.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A remote, unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific PHP URLs within the context of the J-Web process. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D67; 12.3 versions prior to 12.3R12-S5; 12.3X48 versions prior to 12.3X48-D35; 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D44, 14.1X53-D50; 14.2 versions prior to 14.2R7-S7, 14.2R8; 15.1 versions prior to 15.1R3; 15.1X49 versions prior to 15.1X49-D30; 15.1X53 versions prior to 15.1X53-D70.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| juniper junos | = 12.1x46-d10 | No fix listed |
| juniper junos | = 12.1x46-d15 | No fix listed |
| juniper junos | = 12.1x46-d20 | No fix listed |
| juniper junos | = 12.1x46-d25 | No fix listed |
| juniper junos | = 12.1x46-d30 | No fix listed |
| juniper junos | = 12.1x46-d35 | No fix listed |
| juniper junos | = 12.1x46-d40 | No fix listed |
| juniper junos | = 12.1x46-d45 | No fix listed |
| juniper junos | = 12.1x46-d50 | No fix listed |
| juniper junos | = 12.1x46-d55 | No fix listed |
| juniper junos | = 12.1x46-d60 | No fix listed |
| juniper junos | = 12.1x46-d65 | No fix listed |
| juniper junos | = 12.3x48-d10 | No fix listed |
| juniper junos | = 12.3x48-d15 | No fix listed |
| juniper junos | = 12.3x48-d20 | No fix listed |
| juniper junos | = 12.3x48-d25 | No fix listed |
| juniper junos | = 12.3x48-d30 | No fix listed |
| juniper junos | = 15.1x49-d10 | No fix listed |
| juniper junos | = 15.1x49-d20 | No fix listed |
| juniper junos | = 15.1x49-d30 | No fix listed |
| juniper junos | = 15.1x53-d20 | No fix listed |
| juniper junos | = 15.1x53-d21 | No fix listed |
| juniper junos | = 15.1x53-d25 | No fix listed |
| juniper junos | = 15.1x53-d30 | No fix listed |
| juniper junos | = 15.1x53-d32 | No fix listed |
Show 51 more
| Product | Affected versions | Fixed in |
|---|---|---|
| juniper junos | = 15.1x53-d33 | No fix listed |
| juniper junos | = 15.1x53-d34 | No fix listed |
| juniper junos | = 15.1x53-d60 | No fix listed |
| juniper junos | = 15.1x53-d61 | No fix listed |
| juniper junos | = 15.1x53-d62 | No fix listed |
| juniper junos | = 15.1x53-d63 | No fix listed |
| juniper junos | = 14.1 | No fix listed |
| juniper junos | = 14.1-r1 | No fix listed |
| juniper junos | = 14.1-r2 | No fix listed |
| juniper junos | = 14.1-r3 | No fix listed |
| juniper junos | = 14.1-r4 | No fix listed |
| juniper junos | = 14.1-r8 | No fix listed |
| juniper junos | = 14.1-r9 | No fix listed |
| juniper junos | = 14.2-r1 | No fix listed |
| juniper junos | = 14.2-r2 | No fix listed |
| juniper junos | = 14.2-r3 | No fix listed |
| juniper junos | = 14.2-r4 | No fix listed |
| juniper junos | = 14.2-r5 | No fix listed |
| juniper junos | = 14.2-r7 | No fix listed |
| juniper junos | = 14.2-r8 | No fix listed |
| juniper junos | = 15.1-r1 | No fix listed |
| juniper junos | = 15.1-r2 | No fix listed |
| juniper junos | = 12.3 | No fix listed |
| juniper junos | = 12.3-r1 | No fix listed |
| juniper junos | = 12.3-r10 | No fix listed |
| juniper junos | = 12.3-r2 | No fix listed |
| juniper junos | = 12.3-r3 | No fix listed |
| juniper junos | = 12.3-r4 | No fix listed |
| juniper junos | = 12.3-r5 | No fix listed |
| juniper junos | = 12.3-r6 | No fix listed |
| juniper junos | = 12.3-r7 | No fix listed |
| juniper junos | = 12.3-r8 | No fix listed |
| juniper junos | = 12.3-r9 | No fix listed |
| juniper junos | = 14.1x53 | No fix listed |
| juniper junos | = 14.1x53-d10 | No fix listed |
| juniper junos | = 14.1x53-d15 | No fix listed |
| juniper junos | = 14.1x53-d16 | No fix listed |
| juniper junos | = 14.1x53-d25 | No fix listed |
| juniper junos | = 14.1x53-d26 | No fix listed |
| juniper junos | = 14.1x53-d27 | No fix listed |
| juniper junos | = 14.1x53-d35 | No fix listed |
| juniper junos | = 14.1x53-d50 | No fix listed |
| juniper Junos OS | >= 12.1X46, < 12.1X46-D67 | 12.1X46-D67 |
| juniper Junos OS | >= 12.3, < 12.3R12-S5 | 12.3R12-S5 |
| juniper Junos OS | >= 12.3X48, < 12.3X48-D35 | 12.3X48-D35 |
| juniper Junos OS | >= 14.1, < 14.1R8-S5, 14.1R9 | 14.1R8-S5, 14.1R9 |
| juniper Junos OS | >= 14.1X53, < 14.1X53-D44, 14.1X53-D50 | 14.1X53-D44, 14.1X53-D50 |
| juniper Junos OS | >= 14.2, < 14.2R7-S7, 14.2R8 | 14.2R7-S7, 14.2R8 |
| juniper Junos OS | >= 15.1, < 15.1R3 | 15.1R3 |
| juniper Junos OS | >= 15.1X49, < 15.1X49-D30 | 15.1X49-D30 |
| juniper Junos OS | >= 15.1X53, < 15.1X53-D70 | 15.1X53-D70 |
References
- 103092 vdb-entry
- 1040180 third-party-advisory vdb-entry
- kb.juniper.net mitigation patch vendor-advisory