CVE-2016-1278

Juniper Junos OS before 12.1X46-D50 on SRX Series devices reverts to "safe mode" authentication and allows root CLI logins without a password after a failed upgrade to 12.1X46, which might allow local users to gain privileges by leveraging use of the "request system software" command with the "partition" option.

CVSS v3 7.8 HIGH
CVSS v2.0 6.9 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10753	Mitigation Vendor Advisory
http://www.securityfocus.com/bid/91757	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1036307	Third Party Advisory VDB Entry
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10753	Mitigation Vendor Advisory
http://www.securityfocus.com/bid/91757	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1036307	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:o:juniper:junos:*:d45:*:*:*:*:*:*

History

21 Nov 2024, 02:46

Type	Values Removed	Values Added
References	~~() http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10753 - Mitigation, Vendor Advisory~~	() http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10753 - Mitigation, Vendor Advisory
References	~~() http://www.securityfocus.com/bid/91757 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/91757 - Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1036307 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1036307 - Third Party Advisory, VDB Entry

Information

Published : 2016-08-05 15:59

Updated : 2024-11-21 02:46

NVD link : CVE-2016-1278

Mitre link : CVE-2016-1278

CVE.ORG link : CVE-2016-1278

JSON object : View

Products Affected

juniper

junos

CWE

CWE-287

Improper Authentication

{"id": "CVE-2016-1278", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2016-08-05T15:59:05.537", "references": [{"url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10753", "tags": ["Mitigation", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/91757", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1036307", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10753", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/91757", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1036307", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Juniper Junos OS before 12.1X46-D50 on SRX Series devices reverts to \"safe mode\" authentication and allows root CLI logins without a password after a failed upgrade to 12.1X46, which might allow local users to gain privileges by leveraging use of the \"request system software\" command with the \"partition\" option."}, {"lang": "es", "value": "Juniper Junos OS en versiones anteriores a 12.1X46-D50 en dispositivos SRX Series revierte a atenticaci\u00f3n \"modo seguro\" y permite inicios de sesi\u00f3n root CLI sin una contrase\u00f1a despues de un fallo de actualizaci\u00f3n a 12.1X46, lo que podr\u00eda permitir a usuarios locales obtener privilegios aprovechando el uso del comando \"request system software\" con la opci\u00f3n \"partition\"."}], "lastModified": "2024-11-21T02:46:05.767", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:*:d45:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE3C59EA-3089-4693-980B-46969B38DFD1", "versionEndIncluding": "12.1x46"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}