PT-2018-8569 · Juniper Networks · Junos

Published 2018-04-11 · Updated 2019-10-09 · CVE-2018-0019

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 12.1X46-D76 Junos OS versions prior to 12.3R12-S7 Junos OS versions prior to 12.3R13 Junos OS versions prior to 12.3X48-D65 Junos OS versions prior to 14.1R9 Junos OS versions prior to 14.1X53-D130 Junos OS versions prior to 15.1F2-S20 Junos OS versions prior to 15.1F6-S10 Junos OS versions prior to 15.1R7 Junos OS versions prior to 15.1X49-D130 Junos OS versions prior to 15.1X53-D233 Junos OS versions prior to 15.1X53-D471 Junos OS versions prior to 15.1X53-D472 Junos OS versions prior to 15.1X53-D58 Junos OS versions prior to 15.1X53-D66 Junos OS versions prior to 16.1R5-S3 Junos OS versions prior to 16.1R7 Junos OS versions prior to 16.1X65-D47 Junos OS versions prior to 16.1X70-D10 Junos OS versions prior to 16.2R1-S6 Junos OS versions prior to 16.2R2-S5 Junos OS versions prior to 16.2R3 Junos OS versions prior to 17.1R2-S6 Junos OS versions prior to 17.1R3

Description: A vulnerability in the Junos OS SNMP MIB-II subagent daemon (mib2d) may allow a remote network-based attacker to cause the mib2d process to crash, resulting in a denial of service condition for the SNMP subsystem. This can disrupt network monitoring via SNMP but does not impact routing, switching, or firewall functionalities. SNMP is disabled by default on devices running Junos OS.

Recommendations: For Junos OS versions prior to 12.1X46-D76, update to 12.1X46-D76 or later. For Junos OS versions prior to 12.3R12-S7, update to 12.3R12-S7 or later. For Junos OS versions prior to 12.3R13, update to 12.3R13 or later. For Junos OS versions prior to 12.3X48-D65, update to 12.3X48-D65 or later. For Junos OS versions prior to 14.1R9, update to 14.1R9 or later. For Junos OS versions prior to 14.1X53-D130, update to 14.1X53-D130 or later. For Junos OS versions prior to 15.1F2-S20, update to 15.1F2-S20 or later. For Junos OS versions prior to 15.1F6-S10, update to 15.1F6-S10 or later. For Junos OS versions prior to 15.1R7, update to 15.1R7 or later. For Junos OS versions prior to 15.1X49-D130, update to 15.1X49-D130 or later. For Junos OS versions prior to 15.1X53-D233, update to 15.1X53-D233 or later. For Junos OS versions prior to 15.1X53-D471, update to 15.1X53-D471 or later. For Junos OS versions prior to 15.1X53-D472, update to 15.1X53-D472 or later. For Junos OS versions prior to 15.1X53-D58, update to 15.1X53-D58 or later. For Junos OS versions prior to 15.1X53-D66, update to 15.1X53-D66 or later. For Junos OS versions prior to 16.1R5-S3, update to 16.1R5-S3 or later. For Junos OS versions prior to 16.1R7, update to 16.1R7 or later. For Junos OS versions prior to 16.1X65-D47, update to 16.1X65-D47 or later. For Junos OS versions prior to 16.1X70-D10, update to 16.1X70-D10 or later. For Junos OS versions prior to 16.2R1-S6, update to 16.2R1-S6 or later. For Junos OS versions prior to 16.2R2-S5, update to 16.2R2-S5 or later. For Junos OS versions prior to 16.2R3, update to 16.2R3 or later. For Junos OS versions prior to 17.1R2-S6, update to 17.1R2-S6 or later. For Junos OS versions prior to 17.1R3, update to 17.1R3 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-0019

Affected Products

Junos

References · 4

• https://kb.juniper.net/JSA10847 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0019 · Security Note
• http://securitytracker.com/id/1040787 · Note