CVE-2018-0058 : Security Advisory and Response

A vulnerability in Juniper Networks Junos OS on MX Series platforms could lead to a denial of service due to a specially crafted IPv6 exception packet.

Understanding CVE-2018-0058

This CVE involves a specific issue in the processing of Broadband Edge (BBE) client route processing on MX Series subscriber management platforms.

What is CVE-2018-0058?

The vulnerability triggers a kernel crash (vmcore) and subsequent device reboot when a specially designed IPv6 exception packet is received.

The Impact of CVE-2018-0058

Severity: Medium
CVSS Base Score: 5.9
Attack Vector: Network
Availability Impact: High
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None

Technical Details of CVE-2018-0058

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The issue is specific to the Tomcat (Next Generation Subscriber Management) feature in Junos OS 15.1 on MX Series platforms.

Affected Systems and Versions

Juniper Networks Junos OS versions prior to 15.1R7-S2, 15.1R8 on MX Series 15.1
Versions prior to 16.1R4-S11, 16.1R7-S2, 16.1R8 on MX Series 16.1
Versions prior to 16.2R3 on MX Series 16.2
Versions prior to 17.1R2-S9, 17.1R3 on MX Series 17.1
Versions prior to 17.2R2-S6, 17.2R3 on MX Series 17.2
Versions prior to 17.3R2-S4, 17.3R3-S2, 17.3R4 on MX Series 17.3
Versions prior to 17.4R2 on MX Series 17.4
Versions prior to 18.1R2-S3, 18.1R3 on MX Series 18.1
Versions prior to 18.2R1-S1, 18.2R2 on MX Series 18.2

Exploitation Mechanism

Juniper SIRT has not detected any malicious exploitation of this vulnerability.

Mitigation and Prevention

Steps to address and prevent the CVE-2018-0058 vulnerability.

Immediate Steps to Take

Apply the provided software releases to resolve the issue.

Long-Term Security Practices

Regularly update Junos OS to the latest versions.
Monitor vendor security advisories for any new vulnerabilities.

Patching and Updates

Install the following software releases to fix the vulnerability: 15.1R7-S2, 15.1R8, 16.1R4-S11, 16.1R7-S2, 16.1R8, 16.2R3, 17.1R2-S9, 17.1R3, 17.2R2-S6, 17.2R3, 17.3R2-S4, 17.3R3-S2*, 17.3R4, 17.4R2, 18.1R2-S3, 18.1R3, 18.2R1-S1, 18.2R2, 18.3R1, and subsequent releases.

*Available November 2018