Sign-up

ID

VAR-201807-0319


CVE

CVE-2018-0037


TITLE

Juniper Networks Junos OS Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-007986

DESCRIPTION

Junos OS routing protocol daemon (RPD) process may crash and restart or may lead to remote code execution while processing specific BGP NOTIFICATION messages. By continuously sending crafted BGP NOTIFICATION messages, an attacker can repeatedly crash the RPD process causing a sustained Denial of Service. Due to design improvements, this issue does not affect Junos OS 16.1R1, and all subsequent releases. This issue only affects the receiving BGP device and is non-transitive in nature. Affected releases are Juniper Networks Junos OS: 15.1F5 versions starting from 15.1F5-S7 and all subsequent releases; 15.1F6 versions starting from 15.1F6-S3 and later releases prior to 15.1F6-S10; 15.1F7 versions 15.1 versions starting from 15.1R5 and later releases, including the Service Releases based on 15.1R5 and on 15.1R6 prior to 15.1R6-S6 and 15.1R7;. Juniper Networks Junos OS Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Juniper Junos is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely cause a denial-of-service condition. Juniper Junos OS is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware systems. The operating system provides a secure programming interface and Junos SDK. The following releases are affected: Juniper Junos OS Release 15.1, Release 15.1F5, Release 15.1F6, Release 15.1F7

Trust: 1.98

sources: NVD: CVE-2018-0037 // JVNDB: JVNDB-2018-007986 // BID: 105735 // VULHUB: VHN-118239

AFFECTED PRODUCTS

vendor:junipermodel:junosscope:eqversion:15.1

Trust: 1.6

vendor:junipermodel:junos osscope: - version: -

Trust: 0.8

vendor:junipermodel:junos 15.1r6-s6scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1r6-s4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1r6-s3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1r6-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1r6scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1r5-s7scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1r5-s6scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1r5-s5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1r5-s2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1r5-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1r5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1f7scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1f6-s8scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1f6-s7scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1f6-s5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1f6-s4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1f5-s7scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1f5-s5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1f5-s3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1f5-s2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1f5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos os 15.1r6scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1r7scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1f6-s10scope:neversion: -

Trust: 0.3

sources: BID: 105735 // JVNDB: JVNDB-2018-007986 // CNNVD: CNNVD-201807-1081 // NVD: CVE-2018-0037

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-0037
value: CRITICAL

Trust: 1.0

sirt@juniper.net: CVE-2018-0037
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-0037
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201807-1081
value: CRITICAL

Trust: 0.6

VULHUB: VHN-118239
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-0037
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-118239
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-0037
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 2.8

sources: VULHUB: VHN-118239 // JVNDB: JVNDB-2018-007986 // CNNVD: CNNVD-201807-1081 // NVD: CVE-2018-0037 // NVD: CVE-2018-0037

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-118239 // JVNDB: JVNDB-2018-007986 // NVD: CVE-2018-0037

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201807-1081

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201807-1081

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-007986

PATCH
title:JSA10871url:https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10871&actp=METADATA
Trust: 0.8
title:Juniper Junos OS Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=82097
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-007986 // 
            
            
            
            CNNVD: CNNVD-201807-1081

EXTERNAL IDS
db:NVDid:CVE-2018-0037
Trust: 2.8
db:JUNIPERid:JSA10871
Trust: 2.0
db:SECTRACKid:1041339
Trust: 1.7
db:JVNDBid:JVNDB-2018-007986
Trust: 0.8
db:CNNVDid:CNNVD-201807-1081
Trust: 0.7
db:BIDid:105735
Trust: 0.3
db:VULHUBid:VHN-118239
Trust: 0.1
sources:
            
            
            VULHUB: VHN-118239 // 
            
            
            
            BID: 105735 // 
            
            
            
            JVNDB: JVNDB-2018-007986 // 
            
            
            
            CNNVD: CNNVD-201807-1081 // 
            
            
            
            NVD: CVE-2018-0037

REFERENCES
url:https://kb.juniper.net/jsa10871
Trust: 1.7
url:http://www.securitytracker.com/id/1041339
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0037
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-0037
Trust: 0.8
url:http://www.juniper.net/
Trust: 0.3
url:https://kb.juniper.net/infocenter/index?page=content&id=jsa10871
Trust: 0.3
sources:
            
            
            VULHUB: VHN-118239 // 
            
            
            
            BID: 105735 // 
            
            
            
            JVNDB: JVNDB-2018-007986 // 
            
            
            
            CNNVD: CNNVD-201807-1081 // 
            
            
            
            NVD: CVE-2018-0037

CREDITS
Internet2 and The Indiana University GlobalNOC.
Trust: 0.3
sources:
            
            
            BID: 105735

SOURCES
db:VULHUBid:VHN-118239
db:BIDid:105735
db:JVNDBid:JVNDB-2018-007986
db:CNNVDid:CNNVD-201807-1081
db:NVDid:CVE-2018-0037

LAST UPDATE DATE
2024-08-14T14:57:15.728000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-118239date:2019-10-09T00:00:00
db:BIDid:105735date:2018-07-11T00:00:00
db:JVNDBid:JVNDB-2018-007986date:2018-10-04T00:00:00
db:CNNVDid:CNNVD-201807-1081date:2019-10-17T00:00:00
db:NVDid:CVE-2018-0037date:2019-10-09T23:31:03.517

SOURCES RELEASE DATE
db:VULHUBid:VHN-118239date:2018-07-11T00:00:00
db:BIDid:105735date:2018-07-11T00:00:00
db:JVNDBid:JVNDB-2018-007986date:2018-10-04T00:00:00
db:CNNVDid:CNNVD-201807-1081date:2018-07-12T00:00:00
db:NVDid:CVE-2018-0037date:2018-07-11T18:29:00.717