CVE-2018-0015: AppFormix: Debug Shell Command Execution in AppFormix Agent
First published: Thu Feb 22 2018(Updated: )
A malicious user with unrestricted access to the AppFormix application management platform may be able to access a Python debug console and execute system commands with root privilege. The AppFormix Agent exposes the debug console on a host where AppFormix Agent is executing. If the host is executing AppFormix Agent, an attacker may access the debug console and execute Python commands with root privilege. Affected AppFormix releases are: All versions up to and including 2.7.3; 2.11 versions prior to 2.11.3; 2.15 versions prior to 2.15.2. Juniper SIRT is not aware of any malicious exploitation of this vulnerability, however, the issue has been seen in a production network. No other Juniper Networks products or platforms are affected by this issue.
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Formidable Pro2pdf | <=2.7.3 | |
| Formidable Pro2pdf | >=2.11<2.11.3 | |
| Formidable Pro2pdf | >=2.15<2.15.2 |
Remedy
The following software releases have been updated to resolve this specific issue: AppFormix v2.11.3, v2.15.2, and all subsequent releases.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-0015?
CVE-2018-0015 is rated as a critical vulnerability due to the potential for unauthorized root access.
How do I fix CVE-2018-0015?
To mitigate CVE-2018-0015, it is recommended to upgrade to AppFormix version 2.11.3 or later, or any version beyond 2.15.2.
What are the implications of CVE-2018-0015?
CVE-2018-0015 allows a malicious user to execute arbitrary system commands with root privileges, which can lead to full system compromise.
Who is affected by CVE-2018-0015?
CVE-2018-0015 affects users of Juniper AppFormix versions up to 2.7.3, as well as certain ranges of versions up to 2.11.3 and 2.15.2.
Is there a workaround for CVE-2018-0015?
Currently, the best approach to reduce risks from CVE-2018-0015 is to upgrade the software, as no specific workaround is provided.
- agent/type
- agent/softwarecombine
- agent/remedy
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/title
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/juniper
- canonical/formidable pro2pdf
- version/formidable pro2pdf/2.7.3
- version/formidable pro2pdf/2.11
- version/formidable pro2pdf/2.15