CVE-2018-0029 : Exploit Details and Defense Strategies

Enabling promiscuous mode on the fxp0 interface using the command 'monitor traffic interface fxp0' can lead to a system crash and restart (vmcore) during a broadcast storm. This vulnerability affects Junos OS versions 15.1 and later.

Understanding CVE-2018-0029

This CVE involves a specific vulnerability in Junos OS that can result in a system crash and restart under certain conditions.

What is CVE-2018-0029?

CVE-2018-0029 is a vulnerability in Junos OS versions 15.1 and later that can cause a kernel crash (vmcore) when the fxp0 interface is placed into promiscuous mode during a broadcast storm.

The Impact of CVE-2018-0029

CVSS Base Score: 5.7 (Medium)
Attack Vector: Adjacent Network
Availability Impact: High
Attack Complexity: Low
User Interaction: Required
Privileges Required: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Juniper SIRT has not detected any malicious exploitation related to this vulnerability.
The vulnerability can lead to a denial of service (DoS) condition.

Technical Details of CVE-2018-0029

This section provides more in-depth technical details about the CVE.

Vulnerability Description

The vulnerability arises when the fxp0 interface is set to promiscuous mode during a broadcast storm, resulting in a system crash and restart.

Affected Systems and Versions

Junos OS 15.1 versions prior to 15.1F6-S11, 15.1R4-S9, 15.1R6-S6, 15.1R7
Junos OS 15.1X49 versions prior to 15.1X49-D140
Junos OS 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400
Junos OS 15.1X53 versions prior to 15.1X53-D67 on QFX10000 Series
Junos OS 15.1X53 versions prior to 15.1X53-D233 on QFX5110/QFX5200
Junos OS 15.1X53 versions prior to 15.1X53-D471, 15.1X53-D490 on NFX
Versions of 16.1, 16.2, 17.1, 17.2, 17.2X75, 17.3, and 17.4 prior to specified releases

Exploitation Mechanism

The vulnerability is triggered by enabling promiscuous mode on the fxp0 interface during a broadcast storm, leading to a system crash.

Mitigation and Prevention

To address CVE-2018-0029, follow these mitigation strategies:

Immediate Steps to Take

Refrain from executing the 'monitor traffic interface fxp0' command during broadcast storm troubleshooting.

Long-Term Security Practices

Regularly update Junos OS to the patched versions.
Implement network monitoring to detect and mitigate broadcast storms.

Patching and Updates

Apply the following software releases to resolve the issue: 15.1F6-S11*, 15.1R4-S9, 15.1R6-S6, 15.1R7, 15.1X49-D140, 15.1X53-D233, 15.1X53-D471, 15.1X53-D490, 15.1X53-D59, 15.1X53-D67, 16.1R3-S8, 16.1R5-S4, 16.1R6-S1, 16.1R7, 16.2R1-S6, 16.2R2-S5, 16.2R3, 17.1R1-S7, 17.1R2-S7, 17.1R3, 17.2R1-S6, 17.2R2-S4, 17.2R3, 17.2X75-D110, 17.2X75-D90, 17.3R1-S4, 17.3R2, 17.4R1-S3, 17.4R2, 18.1R1, 18.1X75-D10, and subsequent releases.
*Future availability