var-201707-0242
Vulnerability from variot
An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15.1 prior to 15.1R3. Junos versions prior to 15.1 are not affected. No other Juniper Networks products or platforms are affected by this issue. Juniper Junos is prone to a local privilege-escalation vulnerability. Local attackers could exploit this issue to run arbitrary commands with root privileges. The operating system provides a secure programming interface and Junos SDK
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201707-0242", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "junos", "scope": "eq", "trust": 1.6, "vendor": "juniper", "version": "15.1x53" }, { "model": "junos", "scope": "eq", "trust": 1.6, "vendor": "juniper", "version": "15.1" }, { "model": "junos os", "scope": "eq", "trust": 0.8, "vendor": "juniper", "version": "15.1x53-d47" }, { "model": "junos os", "scope": "lt", "trust": 0.8, "vendor": "juniper", "version": "15.1x53" }, { "model": "junos os", "scope": "eq", "trust": 0.8, "vendor": "juniper", "version": "15.1r3" }, { "model": "junos os", "scope": "lt", "trust": 0.8, "vendor": "juniper", "version": "15.1" }, { "model": "junos 15.1x53-d40", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 15.1x53-d35", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 15.1x53-d30", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 15.1x53-d20", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 15.1r2", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 15.1r1", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 15.1x53-d47", "scope": "ne", "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 15.1r3", "scope": "ne", "trust": 0.3, "vendor": "juniper", "version": null } ], "sources": [ { "db": "BID", "id": "100062" }, { "db": "JVNDB", "id": "JVNDB-2017-005978" }, { "db": "NVD", "id": "CVE-2017-10603" }, { "db": "CNNVD", "id": "CNNVD-201707-618" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1x53:d32:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1x53:d33:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1x53:d34:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1x53:d40:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1x53:d45:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1x53:d21:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1x53:d30:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1x53:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1x53:d10:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1x53:d20:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1x53:d25:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:f2-s2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:f2-s3:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:f2-s4:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:f3:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:f1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:f2-s1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:f4:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:f7:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:r2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:a1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:f2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:f6:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:15.1:r1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2017-10603" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The vendor reported this issue.", "sources": [ { "db": "BID", "id": "100062" } ], "trust": 0.3 }, "cve": "CVE-2017-10603", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "NVD", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 3.9, "impactScore": 10.0, "integrityImpact": "COMPLETE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Local", "authentication": "None", "author": "NVD", "availabilityImpact": "Complete", "baseScore": 7.2, "confidentialityImpact": "Complete", "exploitabilityScore": null, "id": "CVE-2017-10603", "impactScore": null, "integrityImpact": "Complete", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "High", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 3.9, "id": "VHN-100942", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "LOCAL", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.8, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, { "attackComplexity": "HIGH", "attackVector": "LOCAL", "author": "sirt@juniper.net", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.0, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, { "attackComplexity": "Low", "attackVector": "Local", "author": "NVD", "availabilityImpact": "High", "baseScore": 7.8, "baseSeverity": "High", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2017-10603", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "Low", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2017-10603", "trust": 1.8, "value": "HIGH" }, { "author": "sirt@juniper.net", "id": "CVE-2017-10603", "trust": 1.0, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-201707-618", "trust": 0.6, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-100942", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-100942" }, { "db": "JVNDB", "id": "JVNDB-2017-005978" }, { "db": "NVD", "id": "CVE-2017-10603" }, { "db": "NVD", "id": "CVE-2017-10603" }, { "db": "CNNVD", "id": "CNNVD-201707-618" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15.1 prior to 15.1R3. Junos versions prior to 15.1 are not affected. No other Juniper Networks products or platforms are affected by this issue. Juniper Junos is prone to a local privilege-escalation vulnerability. \nLocal attackers could exploit this issue to run arbitrary commands with root privileges. The operating system provides a secure programming interface and Junos SDK", "sources": [ { "db": "NVD", "id": "CVE-2017-10603" }, { "db": "JVNDB", "id": "JVNDB-2017-005978" }, { "db": "BID", "id": "100062" }, { "db": "VULHUB", "id": "VHN-100942" } ], "trust": 1.98 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2017-10603", "trust": 2.8 }, { "db": "JUNIPER", "id": "JSA10805", "trust": 2.0 }, { "db": "SECTRACK", "id": "1038901", "trust": 1.7 }, { "db": "JVNDB", "id": "JVNDB-2017-005978", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201707-618", "trust": 0.7 }, { "db": "BID", "id": "100062", "trust": 0.4 }, { "db": "VULHUB", "id": "VHN-100942", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-100942" }, { "db": "BID", "id": "100062" }, { "db": "JVNDB", "id": "JVNDB-2017-005978" }, { "db": "NVD", "id": "CVE-2017-10603" }, { "db": "CNNVD", "id": "CNNVD-201707-618" } ] }, "id": "VAR-201707-0242", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-100942" } ], "trust": 0.01 }, "last_update_date": "2023-12-18T13:48:32.433000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "JSA10805", "trust": 0.8, "url": "https://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10805\u0026actp=metadata" }, { "title": "Juniper Junos OS Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=71736" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2017-005978" }, { "db": "CNNVD", "id": "CNNVD-201707-618" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-91", "trust": 1.1 }, { "problemtype": "CWE-264", "trust": 0.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-100942" }, { "db": "JVNDB", "id": "JVNDB-2017-005978" }, { "db": "NVD", "id": "CVE-2017-10603" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.7, "url": "https://kb.juniper.net/jsa10805" }, { "trust": 1.7, "url": "http://www.securitytracker.com/id/1038901" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-10603" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10603" }, { "trust": 0.3, "url": "http://www.juniper.net/" }, { "trust": 0.3, "url": "http://www.juniper.net/us/en/products-services/nos/junos/" }, { "trust": 0.3, "url": "https://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10805" } ], "sources": [ { "db": "VULHUB", "id": "VHN-100942" }, { "db": "BID", "id": "100062" }, { "db": "JVNDB", "id": "JVNDB-2017-005978" }, { "db": "NVD", "id": "CVE-2017-10603" }, { "db": "CNNVD", "id": "CNNVD-201707-618" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-100942" }, { "db": "BID", "id": "100062" }, { "db": "JVNDB", "id": "JVNDB-2017-005978" }, { "db": "NVD", "id": "CVE-2017-10603" }, { "db": "CNNVD", "id": "CNNVD-201707-618" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-07-17T00:00:00", "db": "VULHUB", "id": "VHN-100942" }, { "date": "2017-07-12T00:00:00", "db": "BID", "id": "100062" }, { "date": "2017-08-14T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-005978" }, { "date": "2017-07-17T13:18:18.687000", "db": "NVD", "id": "CVE-2017-10603" }, { "date": "2017-07-17T00:00:00", "db": "CNNVD", "id": "CNNVD-201707-618" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-10-09T00:00:00", "db": "VULHUB", "id": "VHN-100942" }, { "date": "2017-07-12T00:00:00", "db": "BID", "id": "100062" }, { "date": "2017-08-14T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-005978" }, { "date": "2019-10-09T23:21:38.510000", "db": "NVD", "id": "CVE-2017-10603" }, { "date": "2019-10-17T00:00:00", "db": "CNNVD", "id": "CNNVD-201707-618" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "local", "sources": [ { "db": "BID", "id": "100062" }, { "db": "CNNVD", "id": "CNNVD-201707-618" } ], "trust": 0.9 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Junos OS CLI In XML Injection vulnerability", "sources": [ { "db": "JVNDB", "id": "JVNDB-2017-005978" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "permissions and access control issues", "sources": [ { "db": "CNNVD", "id": "CNNVD-201707-618" } ], "trust": 0.6 } }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.