PT-2015-6050 · Juniper Networks · Junos

Published 2015-07-14 · Updated 2015-07-15 · CVE-2015-3007

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Junos OS versions 12.1X46 before 12.1X46-D35 Junos OS versions 12.1X47 before 12.1X47-D25 Junos OS versions 12.3X48 before 12.3X48-D15

Description The issue is related to the improper implementation of the "set system ports console insecure" feature in the Juniper SRX Series services gateways. This allows physically proximate attackers to gain administrative privileges by leveraging access to the console port.

Recommendations For Junos OS versions 12.1X46 before 12.1X46-D35, update to version 12.1X46-D35 or later. For Junos OS versions 12.1X47 before 12.1X47-D25, update to version 12.1X47-D25 or later. For Junos OS versions 12.3X48 before 12.3X48-D15, update to version 12.3X48-D15 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-3007

Affected Products

Junos

References · 3

• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3007 · Security Note
• http://securitytracker.com/id/1032841 · Note