Security restrictions bypass in Juniper Junos OS



| Updated: 2018-10-11
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2018-0044
CWE-ID CWE-200
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Juniper Junos OS
Operating systems & Components / Operating system

Vendor Juniper Networks, Inc.

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Security restrictions bypass

EUVDB-ID: #VU15306

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-0044

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to an insecure SSHD configuration with the PermitEmptyPasswords option set to "yes" in Juniper Device Manager (JDM) and host OS on Juniper NFX Series devices. A remote attacker can bypass security restrictions to conduct further attacks.

Mitigation

Update to version 18.1R4.

Vulnerable software versions

Juniper Junos OS: 18.1 - 18.1R2

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10878&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###