Quantum Secular Labs / Blog / Advisories
CVE-2018-0057: Juniper Junos: Information disclosure
CVE-2018-0057 is rated critical with a CVSS v3.0 base score of 9.6 and affects Juniper Junos. Per its scoring, it can be exploited over the network, without any user interaction.
Vulnerability description
On MX Series and M120/M320 platforms configured in a Broadband Edge (BBE) environment, subscribers logging in with DHCP Option 50 to request a specific IP address will be assigned the requested IP address, even if there is a static MAC to IP address binding in the access profile. In the problem scenario, with a hardware-address and IP address configured under address-assignment pool, if a subscriber logging in with DHCP Option 50, the subscriber will not be assigned an available address from the matched pool, but will still get the requested IP address. A malicious DHCP subscriber may be able to utilize this vulnerability to create duplicate IP address assignments, leading to a denial of service for valid subscribers or unauthorized information disclosure via IP address assignment spoofing. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S2, 15.1R8; 16.1 versions prior to 16.1R4-S12, 16.1R7-S2, 16.1R8; 16.2 versions prior to 16.2R2-S7, 16.2R3; 17.1 versions prior to 17.1R2-S9, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2-S3, 18.1R3.
Severity breakdown
CVSS v3.0 9.6: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
- Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
- Attack complexity: Low. No special conditions; the attack can be repeated reliably.
- Privileges required: Low. A basic user account is enough.
- User interaction: None. No action from any user is needed.
- Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
- Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
- Integrity impact: None. No loss of integrity.
- Availability impact: High. Total loss of availability; the component can be shut down.
Affected products
- Juniper Junos: 15.1; 15.1 f2; 15.1 f3; 15.1 f4; 15.1 f5; 15.1 f6; 15.1 r1; 15.1 r2; 15.1 r3; 15.1 r4; 15.1 r5; 15.1 r6