PT-2017-3104 · Juniper Networks · Junos

Published 2017-10-11 · Updated 2018-01-05 · CVE-2017-10615

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Junos OS versions 14.1R5 through 14.1R8-S4, 14.1R9 Junos OS versions 14.1X53 through 14.1X53-D50 on EX and QFX series Junos OS versions 14.2R3 through 14.2R7-S8, 14.2R8

Description A vulnerability in the pluggable authentication module (PAM) of Juniper Networks Junos OS may allow an unauthenticated network-based attacker to potentially execute arbitrary code or crash daemons such as telnetd or sshd that make use of PAM. The issue exists due to insufficient input validation in the PAM module.

Recommendations For versions 14.1R5 through 14.1R8-S4, 14.1R9, consider updating to a fixed version to resolve the issue. For versions 14.1X53 through 14.1X53-D50 on EX and QFX series, consider updating to a fixed version to resolve the issue. For versions 14.2R3 through 14.2R7-S8, 14.2R8, consider updating to a fixed version to resolve the issue. As a temporary workaround, consider restricting access to daemons that use PAM, such as telnetd or sshd, until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-02487

CVE-2017-10615

Affected Products

Junos

References · 5

• https://osv.dev/vulnerability/CVE-2017-10615 · Vendor Advisory
• https://kb.juniper.net/JSA10818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10615 · Security Note
• https://bdu.fstec.ru/vul/2017-02487 · Security Note
• http://securitytracker.com/id/1040039 · Note