SB2018101023 - Security restrictions bypass in Juniper Junos OS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018101023

SB2018101023 - Security restrictions bypass in Juniper Junos OS

Published: October 10, 2018 Updated: October 11, 2018

Security Bulletin ID SB2018101023
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Security restrictions bypass (CVE-ID: CVE-2018-0044)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to an insecure SSHD configuration with the PermitEmptyPasswords option set to "yes" in Juniper Device Manager (JDM) and host OS on Juniper NFX Series devices. A remote attacker can bypass security restrictions to conduct further attacks.


Remediation

Install update from vendor's website.

References