Sign-up

ID

VAR-201507-0639


CVE

CVE-2015-3007


TITLE

Juniper SRX Series service gateway Junos OS Vulnerabilities in which administrator privileges are obtained

Trust: 0.8

sources: JVNDB: JVNDB-2015-003639

DESCRIPTION

The Juniper SRX Series services gateways with Junos OS 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, and 12.3X48 before 12.3X48-D15 do not properly implement the "set system ports console insecure" feature, which allows physically proximate attackers to gain administrative privileges by leveraging access to the console port. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. The Juniper SRX Series is Juniper Networks' SRX series of devices running the Junos operating system. Juniper Junos is prone to a local security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions. The following releases are affected: Junos OS 12.1X46 prior to 12.1X46-D35, 12.1X47 prior to 12.1X47-D25, and 12.3X48 prior to 12.3X48-D15

Trust: 2.52

sources: NVD: CVE-2015-3007 // JVNDB: JVNDB-2015-003639 // CNVD: CNVD-2015-04710 // BID: 75718 // VULHUB: VHN-80968

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2015-04710

AFFECTED PRODUCTS

vendor:junipermodel:junosscope:eqversion:12.1x46

Trust: 1.6

vendor:junipermodel:junosscope:eqversion:12.3x48

Trust: 1.6

vendor:junipermodel:junosscope:eqversion:12.1x47

Trust: 1.6

vendor:junipermodel:junos osscope:eqversion:12.1x47-d25

Trust: 0.8

vendor:junipermodel:junos osscope:ltversion:12.1x46

Trust: 0.8

vendor:junipermodel:junos osscope:ltversion:12.3x48

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:12.3x48-d15

Trust: 0.8

vendor:junipermodel:junos osscope:ltversion:12.1x47

Trust: 0.8

vendor:junipermodel:junos osscope:eqversion:12.1x46-d35

Trust: 0.8

vendor:junipermodel:networks junos os 12.1x46scope: - version: -

Trust: 0.6

vendor:junipermodel:networks junos os 12.1x47scope: - version: -

Trust: 0.6

vendor:junipermodel:networks junos os 12.3x48scope: - version: -

Trust: 0.6

vendor:junipermodel:junos 12.3x48-d10scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d20scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d15scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d11scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d10scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d30scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d25scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d20.5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d20scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d15scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d15scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d25scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d35scope:neversion: -

Trust: 0.3

sources: CNVD: CNVD-2015-04710 // BID: 75718 // JVNDB: JVNDB-2015-003639 // CNNVD: CNNVD-201507-363 // NVD: CVE-2015-3007

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-3007
value: HIGH

Trust: 1.0

NVD: CVE-2015-3007
value: HIGH

Trust: 0.8

CNVD: CNVD-2015-04710
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201507-363
value: HIGH

Trust: 0.6

VULHUB: VHN-80968
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-3007
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-04710
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-80968
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2015-04710 // VULHUB: VHN-80968 // JVNDB: JVNDB-2015-003639 // CNNVD: CNNVD-201507-363 // NVD: CVE-2015-3007

PROBLEMTYPE DATA

problemtype:CWE-284

Trust: 1.1

problemtype:CWE-Other

Trust: 0.8

sources: VULHUB: VHN-80968 // JVNDB: JVNDB-2015-003639 // NVD: CVE-2015-3007

THREAT TYPE

local

Trust: 0.9

sources: BID: 75718 // CNNVD: CNNVD-201507-363

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201507-363

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-003639

PATCH
title:JSA10683url:http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10683
Trust: 0.8
title:Juniper SRX Series services gateways permission to obtain vulnerability patchesurl:https://www.cnvd.org.cn/patchInfo/show/61156
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-04710 // 
            
            
            
            JVNDB: JVNDB-2015-003639

EXTERNAL IDS
db:NVDid:CVE-2015-3007
Trust: 3.4
db:JUNIPERid:JSA10683
Trust: 2.6
db:SECTRACKid:1032841
Trust: 1.7
db:BIDid:75718
Trust: 1.0
db:JVNDBid:JVNDB-2015-003639
Trust: 0.8
db:CNNVDid:CNNVD-201507-363
Trust: 0.7
db:CNVDid:CNVD-2015-04710
Trust: 0.6
db:VULHUBid:VHN-80968
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-04710 // 
            
            
            
            VULHUB: VHN-80968 // 
            
            
            
            BID: 75718 // 
            
            
            
            JVNDB: JVNDB-2015-003639 // 
            
            
            
            CNNVD: CNNVD-201507-363 // 
            
            
            
            NVD: CVE-2015-3007

REFERENCES
url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10683
Trust: 2.2
url:http://www.securitytracker.com/id/1032841
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3007
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3007
Trust: 0.8
url:http://www.juniper.net/
Trust: 0.3
url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10683&cat=sirt_1&actp=list
Trust: 0.3
url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10683
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-04710 // 
            
            
            
            VULHUB: VHN-80968 // 
            
            
            
            BID: 75718 // 
            
            
            
            JVNDB: JVNDB-2015-003639 // 
            
            
            
            CNNVD: CNNVD-201507-363 // 
            
            
            
            NVD: CVE-2015-3007

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 75718

SOURCES
db:CNVDid:CNVD-2015-04710
db:VULHUBid:VHN-80968
db:BIDid:75718
db:JVNDBid:JVNDB-2015-003639
db:CNNVDid:CNNVD-201507-363
db:NVDid:CVE-2015-3007

LAST UPDATE DATE
2025-04-12T23:30:41.383000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-04710date:2015-07-22T00:00:00
db:VULHUBid:VHN-80968date:2015-07-15T00:00:00
db:BIDid:75718date:2015-07-13T00:00:00
db:JVNDBid:JVNDB-2015-003639date:2015-07-17T00:00:00
db:CNNVDid:CNNVD-201507-363date:2015-07-15T00:00:00
db:NVDid:CVE-2015-3007date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CNVDid:CNVD-2015-04710date:2015-07-22T00:00:00
db:VULHUBid:VHN-80968date:2015-07-14T00:00:00
db:BIDid:75718date:2015-07-13T00:00:00
db:JVNDBid:JVNDB-2015-003639date:2015-07-17T00:00:00
db:CNNVDid:CNNVD-201507-363date:2015-07-15T00:00:00
db:NVDid:CVE-2015-3007date:2015-07-14T17:59:03.400