Vulnerabilities > CVE-2018-0009 - Unspecified vulnerability in Juniper Junos 12.1X46/12.3X48/15.1X49

047910
CVSS 5.9 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
HIGH
Availability impact
NONE
network
high complexity
juniper
nessus
NVD
Published: 2018-01-10
Updated: 2019-10-09

Summary

On Juniper Networks SRX series devices, firewall rules configured to match custom application UUIDs starting with zeros can match all TCP traffic. Due to this issue, traffic that should have been blocked by other rules is permitted to flow through the device resulting in a firewall bypass condition. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D71 on SRX series; 12.3X48 versions prior to 12.3X48-D55 on SRX series; 15.1X49 versions prior to 15.1X49-D100 on SRX series.

Vulnerable Configurations

Part Description Count
OS
Juniper
40
Hardware
Juniper
20

Nessus

NASL familyJunos Local Security Checks
NASL idJUNIPER_JSA10836.NASL
descriptionAccording to its self-reported version number, the remote Junos device is affected by a firewall bypass vulnerability.
last seen2020-06-01
modified2020-06-02
plugin id106393
published2018-01-26
reporterThis script is Copyright (C) 2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/106393
titleJuniper Junos Custom Application UUID Rule Handling Remote Firewall Bypass Vulnerability (JSA10836)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(106393);
  script_version("1.4");
  script_cvs_date("Date: 2018/07/12 19:01:16");

  script_cve_id("CVE-2018-0009");
  script_bugtraq_id(102491);
  script_xref(name:"JSA", value:"JSA10836");

  script_name(english:"Juniper Junos Custom Application UUID Rule Handling Remote Firewall Bypass Vulnerability (JSA10836)");
  script_summary(english:"Checks the Junos version and build date.");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the remote Junos device
is affected by a firewall bypass vulnerability.");
  # https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10836&actp=METADATA
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?16669b8c");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in
Juniper advisory JSA10836.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/01/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/01/26");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2018 Tenable Network Security, Inc.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version", "Host/Juniper/model");

  exit(0);
}

include("audit.inc");
include("junos_kb_cmd_func.inc");

ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');
model = get_kb_item_or_exit('Host/Juniper/model');

if (model !~ "^SRX")
  audit(AUDIT_HOST_NOT, 'an SRX model');

# Affected:
# 12.1X46 versions prior to 12.1X46-D71 on SRX series
# 12.3X48 versions prior to 12.3X48-D55 on SRX series
# 15.1X49 versions prior to 15.1X49-D100 on SRX series

fixes = make_array();
fixes['12.1X46'] = '12.1X46-D71';
fixes['12.3X48'] = '12.3X48-D55';
fixes['15.1X49'] = '15.1X49-D100';

fix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE);

override = FALSE;

junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_NOTE);

References