Vulnerability Details : CVE-2014-6379
Juniper Junos 11.4 before R12, 12.1 before R10, 12.1X44 before D35, 12.1X45 before D25, 12.1X46 before D20, 12.1X47 before D10, 12.2 before R8, 12.2X50 before D70, 12.3 before R6, 13.1 before R4-S3, 13.1X49 before D55, 13.1X50 before D30, 13.2 before R4, 13.2X50 before D20, 13.2X51 before D26 and D30, 13.2X52 before D15, 13.3 before R2, and 14.1 before R1, when a RADIUS accounting server is configured as [system accounting destination radius], creates an entry in /var/etc/pam_radius.conf, which might allow remote attackers to bypass authentication via unspecified vectors.
Vulnerability category: BypassGain privilege
Products affected by CVE-2014-6379
- cpe:2.3:o:juniper:junos:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.1:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.1x44:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.2:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.3:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.1x45:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.1x46:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:13.3:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.1r:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:14.1:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.1x47:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.3:r7:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:13.2x50:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:13.2x51:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:13.2x52:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.2x50:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:13.1x49:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:13.1x50:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:13.1:r4-s2:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-6379
0.65%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 79 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-6379
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2014-6379
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-6379
-
http://www.securityfocus.com/bid/70365
Juniper Junos CVE-2014-6379 Security Bypass Vulnerability
-
http://www.securitytracker.com/id/1031010
Juniper Junos Duplicate RADIUS Configuration Entry May Let Remote Users Bypass Authentication in Certain Cases - SecurityTracker
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/96905
Juniper Junos RADIUS security bypass CVE-2014-6379 Vulnerability Report
-
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10654
Juniper Networks - 2014-10 Security Bulletin: Junos: RADIUS accounting servers create additional entries in pam_radius.conf (CVE-2014-6379)Vendor Advisory
Jump to