CVE-2021-0218
Assigner: juniper
Published: 2021-01-13T00:00:00
State: PUBLISHED
affected: product: Junos OS
vendor: Juniper Networks
versions: lessThan: 16.1R1
status: unaffected
version: unspecified
versionType: custom
lessThan: 17.3R3-S9
status: affected
version: 17.3
versionType: custom
lessThan: 17.4R2-S12, 17.4R3-S3
status: affected
version: 17.4
versionType: custom
lessThan: 18.1R3-S11
status: affected
version: 18.1
versionType: custom
lessThan: 18.2R3-S6
status: affected
version: 18.2
versionType: custom
lessThan: 18.3R3-S4
status: affected
version: 18.3
versionType: custom
lessThan: 18.4R3-S6
status: affected
version: 18.4
versionType: custom
lessThan: 19.1R1-S6, 19.1R2-S2, 19.1R3-S3
status: affected
version: 19.1
versionType: custom
lessThan: 19.2R3-S1
status: affected
version: 19.2
versionType: custom
lessThan: 19.3R2-S5, 19.3R3
status: affected
version: 19.3
versionType: custom
lessThan: 19.4R2-S2, 19.4R3
status: affected
version: 19.4
versionType: custom
lessThan: 20.1R1-S4, 20.1R2
status: affected
version: 20.1
versionType: custom
lessThan: 20.2R1-S2, 20.2R2
status: affected
version: 20.2
versionType: custom
credits: value: Juniper SIRT would like to acknowledge and thank Hoàng Thạch Nguyễn (d4rkn3ss) of STAR Labs for responsibly reporting this vulnerability.
datePublic: 2021-01-13T00:00:00
descriptions: value: A command injection vulnerability in the license-check daemon of Juniper Networks Junos OS that may allow a locally authenticated attacker with low privileges to execute commands with root privilege. license-check is a daemon used to manage licenses in Junos OS. To update licenses, a user executes the command 'request system license update' via the CLI. An attacker with access to this CLI command may be able to exploit the vulnerability. This issue affects Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R2-S12, 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S6; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R3-S6; 19.1 versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S3; 19.2 versions prior to 19.2R3-S1; 19.3 versions prior to 19.3R2-S5, 19.3R3; 19.4 versions prior to 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R1-S4, 20.1R2; 20.2 versions prior to 20.2R1-S2, 20.2R2.
exploits: value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-78
description: CWE-78 OS Command Injection
type: CWE
solutions: value: The following software releases have been updated to resolve this specific issue: Junos OS 17.3R3-S9, 17.4R2-S12, 17.4R3-S3, 18.1R3-S11, 18.2R3-S6, 18.3R3-S4, 18.4R3-S6, 19.1R1-S6, 19.1R2-S2, 19.1R3-S3, 19.2R3-S1, 19.3R2-S5, 19.3R3, 19.4R2-S2, 19.4R3, 20.1R1-S4, 20.1R2, 20.2R1-S2, 20.2R2, 20.3R1, and all subsequent releases.

source: advisory: JSA11108
defect: 1519336
discovery: EXTERNAL
title: Junos OS: Command injection vulnerability in license-check daemon
workarounds: value: Use access lists or firewall filters to limit CLI access to the device only from trusted, administrative networks or hosts.

Limit access to the Junos OS CLI to only trusted system administrators.

Restrict access to the 'request system license update' CLI command.

x_generator: engine: Vulnogram 0.0.9