Test ID:	1.3.6.1.4.1.25623.1.0.105911
Category:	JunOS Local Security Checks
Title:	Juniper Networks Junos OS J-Web Sajax Remote Code Execution Vulnerability
Summary:	Remote Code Execution on J-Web
Description:	Summary: Remote Code Execution on J-Web Vulnerability Insight: Juniper Junos could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by the failure to restrict access to /jsdm/ajax/port.php. If J-Web is enabled, an attacker could send specially-crafted data to execute arbitrary OS commands on the system with root privileges. Vulnerability Impact: A user with low privilege (such as read only access) may get complete administrative access. The vulnerability is limited to only users with valid, authenticated login credentials. Affected Software/OS: Junos OS 10.4, 11.4, 12.1, 12.2 and 12.3. Solution: New builds of Junos OS software are available from Juniper. As a workaround disable J-Web. CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-6618 BugTraq ID: 62305 http://www.securityfocus.com/bid/62305 http://www.exploit-db.com/exploits/29544 http://www.senseofsecurity.com.au/advisories/SOS-13-003 http://www.securitytracker.com/id/1029016 http://secunia.com/advisories/54731 XForce ISS Database: juniper-port-command-execution(87011) https://exchange.xforce.ibmcloud.com/vulnerabilities/87011
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.