CVE-2014-6384: Medium severity junos os evolved vulnerability

Published Jan 16, 2015

Updated

Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D15, 12.3 before 12.3R9, 13.1 before 13.1R4-S3, 13.2 before 13.2R6, 13.3 before 13.3R5, 14.1 before 14.1R3, and 14.2 before 14.2R1 does not properly handle double quotes in authorization attributes in the TACACS+ configuration, which allows local users to bypass the security policy and execute commands via unspecified vectors.

Affected Software

43 affected components

Juniper Junos=12.1x44

Juniper Junos=12.1x44-d10

Juniper Junos=12.1x44-d15

Juniper Junos=12.1x44-d20

Juniper Junos=12.1x44-d25

Juniper Junos=12.1x44-d30

Juniper Junos=12.1x44-d35

Juniper Junos=12.1x44-d40

Juniper Junos=12.1x46

Juniper Junos=12.1x46-d10

Juniper Junos=12.1x46-d15

Juniper Junos=12.1x46-d20

Juniper Junos=12.1x47

Juniper Junos=12.1x47-d10

Juniper Junos=12.3

Juniper Junos=12.3-r1

Juniper Junos=12.3-r2

Juniper Junos=12.3-r3

Juniper Junos=12.3-r4

Juniper Junos=12.3-r5

Juniper Junos=12.3-r6

Juniper Junos=12.3-r7

Juniper Junos=12.3-r8

Juniper Junos=13.1

Juniper Junos=13.1-r1

Juniper Junos=13.1-r2

Juniper Junos=13.1-r3

Juniper Junos=13.1-r4

Juniper Junos=13.2

Juniper Junos=13.2-r1

Juniper Junos=13.2-r2

Juniper Junos=13.2-r3

Juniper Junos=13.2-r4

Juniper Junos=13.2-r5

Juniper Junos=13.3

Juniper Junos=13.3-r1

Juniper Junos=13.3-r2

Juniper Junos=13.3-r3

Juniper Junos=13.3-r4

Juniper Junos=14.1

Juniper Junos=14.1-r1

Juniper Junos=14.1-r2

Juniper Junos=14.2

Event History

Jan 16, 2015

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-6384?

CVE-2014-6384 is classified as a medium severity vulnerability that can lead to improper handling of double quotes in authorization attributes.

How do I fix CVE-2014-6384?

To fix CVE-2014-6384, update your Junos software to a version that is not vulnerable, such as 12.1X44-D45 or later, 12.1X46-D25 or later, etc.

What versions of Junos are affected by CVE-2014-6384?

CVE-2014-6384 affects various versions of Junos, including versions 12.1X44 prior to D45 and 12.3 prior to R9 among others.

What is the impact of exploiting CVE-2014-6384?

Exploiting CVE-2014-6384 could potentially allow an attacker to bypass authorization checks.

Is there a workaround for CVE-2014-6384?

As of now, the recommended approach is to upgrade to a patched version of Junos, as there are no known workarounds.