Vulnerability Name:

CVE-2018-0025

Assigned:2017-11-16
Published:2018-07-11
Updated:2018-09-11
Summary:When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services, a client sending authentication credentials in the initial HTTP/HTTPS session is at risk that these credentials may be captured during follow-on HTTP/HTTPS requests by a malicious actor through a man-in-the-middle attack or by authentic servers subverted by malicious actors. FTP, and Telnet pass-through authentication services are not affected. Affected releases are Juniper Networks SRX Series: 12.1X46 versions prior to 12.1X46-D67 on SRX Series; 12.3X48 versions prior to 12.3X48-D25 on SRX Series; 15.1X49 versions prior to 15.1X49-D35 on SRX Series.
CVSS v3 Severity:8.1 High (CVSS v3 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.1 High (Temporal CVSS v3 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
6.1 Medium (CCN CVSS v3 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N)
5.3 Medium (CCN Temporal CVSS v3 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.9 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:C/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-255
References:Source: BID
Type: VENDOR_ADVISORY
104719

Source: SECTRACK
Type: VENDOR_ADVISORY
1041316

Source: XF
Type: UNKNOWN
juniper-junos-cve20180025-info-disc(146319)

Source: CONFIRM
Type: VENDOR_ADVISORY
https://kb.juniper.net/JSA10858

Source: MISC
Type: VENDOR_ADVISORY
https://www.juniper.net/documentation/en_US/junos/topics/concept/firewall-user-authentication-pass-through-understanding.html

Source: MISC
Type: VENDOR_ADVISORY
https://www.juniper.net/documentation/en_US/junos/topics/example/firewall-user-authentication-pass-through-configuring-cli.html

Source: MISC
Type: VENDOR_ADVISORY
https://www.juniper.net/documentation/en_US/junos/topics/example/security-https-traffic-to-trigger-pass-through-authentication-configuring.html

Vulnerable Configuration:Configuration 1:
  • cpe:/o:juniper:junos:12.1x46:*:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d10:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d15:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d20:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d25:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d30:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d35:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d40:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d45:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d50:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d55:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d60:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d65:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.1x46:d66:*:*:*:*:*:*
  • AND
  • cpe:/h:juniper:srx100:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx110:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx1400:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx1500:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx210:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx220:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx240:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx300:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx320:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx340:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx3400:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx345:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx3600:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx4100:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx4200:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx5400:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx550:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx5600:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx5800:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx650:-:*:*:*:*:*:*:*

  • Configuration 2:
  • cpe:/o:juniper:junos:12.3x48:*:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.3x48:d10:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.3x48:d15:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:12.3x48:d20:*:*:*:*:*:*
  • AND
  • cpe:/h:juniper:srx100:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx110:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx1400:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx1500:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx210:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx220:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx240:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx300:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx320:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx340:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx3400:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx345:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx3600:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx4100:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx4200:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx5400:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx550:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx5600:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx5800:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx650:-:*:*:*:*:*:*:*

  • Configuration 3:
  • cpe:/o:juniper:junos:15.1x49:*:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:15.1x49:d10:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:15.1x49:d20:*:*:*:*:*:*
  • OR cpe:/o:juniper:junos:15.1x49:d30:*:*:*:*:*:*
  • AND
  • cpe:/h:juniper:srx100:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx110:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx1400:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx1500:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx210:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx220:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx240:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx300:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx320:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx340:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx3400:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx345:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx3600:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx4100:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx4200:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx5400:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx550:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx5600:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx5800:-:*:*:*:*:*:*:*
  • OR cpe:/h:juniper:srx650:-:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    BACK
    juniper junos 12.1x46
    juniper junos 12.1x46 d10
    juniper junos 12.1x46 d15
    juniper junos 12.1x46 d20
    juniper junos 12.1x46 d25
    juniper junos 12.1x46 d30
    juniper junos 12.1x46 d35
    juniper junos 12.1x46 d40
    juniper junos 12.1x46 d45
    juniper junos 12.1x46 d50
    juniper junos 12.1x46 d55
    juniper junos 12.1x46 d60
    juniper junos 12.1x46 d65
    juniper junos 12.1x46 d66
    juniper srx100 -
    juniper srx110 -
    juniper srx1400 -
    juniper srx1500 -
    juniper srx210 -
    juniper srx220 -
    juniper srx240 -
    juniper srx300 -
    juniper srx320 -
    juniper srx340 -
    juniper srx3400 -
    juniper srx345 -
    juniper srx3600 -
    juniper srx4100 -
    juniper srx4200 -
    juniper srx5400 -
    juniper srx550 -
    juniper srx5600 -
    juniper srx5800 -
    juniper srx650 -
    juniper junos 12.3x48
    juniper junos 12.3x48 d10
    juniper junos 12.3x48 d15
    juniper junos 12.3x48 d20
    juniper srx100 -
    juniper srx110 -
    juniper srx1400 -
    juniper srx1500 -
    juniper srx210 -
    juniper srx220 -
    juniper srx240 -
    juniper srx300 -
    juniper srx320 -
    juniper srx340 -
    juniper srx3400 -
    juniper srx345 -
    juniper srx3600 -
    juniper srx4100 -
    juniper srx4200 -
    juniper srx5400 -
    juniper srx550 -
    juniper srx5600 -
    juniper srx5800 -
    juniper srx650 -
    juniper junos 15.1x49
    juniper junos 15.1x49 d10
    juniper junos 15.1x49 d20
    juniper junos 15.1x49 d30
    juniper srx100 -
    juniper srx110 -
    juniper srx1400 -
    juniper srx1500 -
    juniper srx210 -
    juniper srx220 -
    juniper srx240 -
    juniper srx300 -
    juniper srx320 -
    juniper srx340 -
    juniper srx3400 -
    juniper srx345 -
    juniper srx3600 -
    juniper srx4100 -
    juniper srx4200 -
    juniper srx5400 -
    juniper srx550 -
    juniper srx5600 -
    juniper srx5800 -
    juniper srx650 -