Remote denial of service in rpcbind in Juniper Junos OS

Published: 2018-07-16 | Updated: 2019-01-10

Risk	Low
Patch available	YES
Number of vulnerabilities	1
CVE-ID	CVE-2015-7236
CWE-ID	CWE-416
Exploitation vector	Local network
Public exploit	N/A
Vulnerable software Subscribe	Juniper Junos OS Operating systems & Components / Operating system
Vendor	Juniper Networks, Inc.

Security Bulletin

This security bulletin contains information about 1 vulnerabilities.

This issue affects Junos OS 12.1X46, 12.3, 12.3X48, 14.1X53, 15.1, 15.1X49, 15.1X53, 15.1X54, 16.1.

1) Use-after-free

EUVDB-ID: #VU2752

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-7236

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error in xprt_set_caller() function in rpcb_svc_com.c in rpcbind 0.2.1 and earlier. A remote attacker can cause a denial of service (daemon crash) via specially crafted packets that involve PMAP_CALLIT code.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install patch from vendor's website.

Vulnerable software versions

Juniper Junos OS: 12.1x46 - 16.1R1

External links

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10860&cat=SIRT_1&actp=LIST

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.