PT-2018-8568 · Juniper Networks · Junos

Published 2018-04-11 · Updated 2019-10-09 · CVE-2018-0018

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 12.1X46-D60 on SRX Junos OS versions prior to 12.3X48-D35 on SRX Junos OS versions prior to 15.1X49-D60 on SRX

Description: An issue exists where an attacker sending specially crafted packets may be able to bypass firewall rules, leading to information disclosure. This could allow an attacker to gain control of the target device or other internal devices, systems, or services protected by the SRX Series device. The issue only applies to devices where IDP policies are applied to one or more rules.

Recommendations: For Junos OS versions prior to 12.1X46-D60 on SRX, update to version 12.1X46-D60 or later. For Junos OS versions prior to 12.3X48-D35 on SRX, update to version 12.3X48-D35 or later. For Junos OS versions prior to 15.1X49-D60 on SRX, update to version 15.1X49-D60 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-0018

Affected Products

Junos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0018 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0018 · Vendor Advisory
• https://kb.juniper.net/JSA10846 · Vendor Advisory
• http://securitytracker.com/id/1040786 · Note
• http://securityfocus.com/bid/103748 · Note