CVE-2018-0001: Junos: Unauthenticated Remote Code Execution through J-Web interface

Published Jan 10, 2018

Updated

A remote, unauthenticated attacker may be able to execute code by exploiting a use-after-free defect found in older versions of PHP through injection of crafted data via specific PHP URLs within the context of the J-Web process. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D67; 12.3 versions prior to 12.3R12-S5; 12.3X48 versions prior to 12.3X48-D35; 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D44, 14.1X53-D50; 14.2 versions prior to 14.2R7-S7, 14.2R8; 15.1 versions prior to 15.1R3; 15.1X49 versions prior to 15.1X49-D30; 15.1X53 versions prior to 15.1X53-D70.

Affected Software

67 affected components

Juniper Junos=12.1x46-d10

Juniper Junos=12.1x46-d15

Juniper Junos=12.1x46-d20

Juniper Junos=12.1x46-d25

Juniper Junos=12.1x46-d30

Juniper Junos=12.1x46-d35

Juniper Junos=12.1x46-d40

Juniper Junos=12.1x46-d45

Juniper Junos=12.1x46-d50

Juniper Junos=12.1x46-d55

Juniper Junos=12.1x46-d60

Juniper Junos=12.1x46-d65

Juniper Junos=12.3x48-d10

Juniper Junos=12.3x48-d15

Juniper Junos=12.3x48-d20

Juniper Junos=12.3x48-d25

Juniper Junos=12.3x48-d30

Juniper Junos=15.1x49-d10

Juniper Junos=15.1x49-d20

Juniper Junos=15.1x49-d30

Juniper Junos=15.1x53-d20

Juniper Junos=15.1x53-d21

Juniper Junos=15.1x53-d25

Juniper Junos=15.1x53-d30

Juniper Junos=15.1x53-d32

Juniper Junos=15.1x53-d33

Juniper Junos=15.1x53-d34

Juniper Junos=15.1x53-d60

Juniper Junos=15.1x53-d61

Juniper Junos=15.1x53-d62

Juniper Junos=15.1x53-d63

Juniper Junos=14.1

Juniper Junos=14.1-r1

Juniper Junos=14.1-r2

Juniper Junos=14.1-r3

Juniper Junos=14.1-r4

Juniper Junos=14.1-r8

Juniper Junos=14.1-r9

Juniper Junos=14.2-r1

Juniper Junos=14.2-r2

Juniper Junos=14.2-r3

Juniper Junos=14.2-r4

Juniper Junos=14.2-r5

Juniper Junos=14.2-r7

Juniper Junos=14.2-r8

Juniper Junos=15.1-r1

Juniper Junos=15.1-r2

Juniper Junos=12.3

Juniper Junos=12.3-r1

Juniper Junos=12.3-r10

Juniper Junos=12.3-r2

Juniper Junos=12.3-r3

Juniper Junos=12.3-r4

Juniper Junos=12.3-r5

Juniper Junos=12.3-r6

Juniper Junos=12.3-r7

Juniper Junos=12.3-r8

Juniper Junos=12.3-r9

Juniper Junos=14.1x53

Juniper Junos=14.1x53-d10

Juniper Junos=14.1x53-d15

Juniper Junos=14.1x53-d16

Juniper Junos=14.1x53-d25

Juniper Junos=14.1x53-d26

Juniper Junos=14.1x53-d27

Juniper Junos=14.1x53-d35

Juniper Junos=14.1x53-d50

Remediation

Patch Available

https://kb.juniper.net/JSA10828

Information

The following software releases have been updated to resolve this specific issue: 12.1X46-D67, 12.3R12-S8*, 12.3X48-D55, 14.1R8-S5, 14.1R9, 14.1X53-D44, 14.1X53-D50, 14.2R7-S7, 14.2R8, 15.1F5-S8, 15.1F6-S8, 15.1R5-S6, 15.1R7, 15.1X49-D100, 15.1X53-D70, 16.1R4-S6, 16.1R5, 16.2R2-S2, 16.2R3, 17.1R2-S5*, 17.1R3*, 17.2R2, 17.3R1, and all subsequent releases. *Pending release NOTE: While Junos OS 12.3R12-S5, 12.3X48-D35, 15.1F2+, 15.1R3, 15.1X49-D30, and all subsequent releases are not vulnerable, this issue has been proactively resolved.

Event History

Jan 10, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0001?

CVE-2018-0001 is categorized as a high-severity vulnerability because it allows remote unauthenticated code execution.

How do I fix CVE-2018-0001?

To fix CVE-2018-0001, you should upgrade to the latest version of Junos OS that addresses this vulnerability.

What software versions are affected by CVE-2018-0001?

CVE-2018-0001 affects multiple versions of Juniper Networks Junos OS, particularly versions 12.1X46 and 12.3X48, among others.

What type of vulnerability is CVE-2018-0001?

CVE-2018-0001 is a use-after-free vulnerability that can be exploited through crafted data sent to the J-Web process.

Can CVE-2018-0001 be exploited remotely?

Yes, CVE-2018-0001 can be exploited remotely by attackers without authentication.