Lucene search

[email protected]CVE-2013-4685

HistoryJul 11, 2013 - 2:55 p.m.

CVE-2013-4685

2013-07-1114:55:01

CWE-119

[email protected]

web.nvd.nist.gov

cve-2013-4685

buffer overflow

juniper junos

srx devices

remote code execution

captive portal

uac enforcer

http requests

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

8.2 High

AI Score

Confidence

Low

0.023 Low

EPSS

Percentile

89.8%

JSON

Buffer overflow in flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7, 12.1 before 12.1R6, and 12.1X44 before 12.1X44-D15 on SRX devices, when Captive Portal is enabled with the UAC enforcer role, allows remote attackers to execute arbitrary code via crafted HTTP requests, aka PR 849100.

Affected configurations

NVD

Node

juniperjunosMatch10.4

juniperjunosMatch11.4

juniperjunosMatch12.1

juniperjunosMatch12.1x44

AND

junipersrx100Match-

junipersrx110Match-

junipersrx1400Match-

junipersrx210Match-

junipersrx220Match-

junipersrx240Match-

junipersrx3400Match-

junipersrx3600Match-

junipersrx550Match-

junipersrx5600Match-

junipersrx5800Match-

junipersrx650Match-

CPENameOperatorVersion
juniper:junosjuniper junoseq10.4
juniper:junosjuniper junoseq11.4
juniper:junosjuniper junoseq12.1
juniper:junosjuniper junoseq12.1x44
juniper:srx100juniper srx100eq-
juniper:srx110juniper srx110eq-
juniper:srx1400juniper srx1400eq-
juniper:srx210juniper srx210eq-
juniper:srx220juniper srx220eq-
juniper:srx240juniper srx240eq-

CPE	Name	Operator	Version
juniper:junos	juniper junos	eq	10.4
juniper:junos	juniper junos	eq	11.4
juniper:junos	juniper junos	eq	12.1
juniper:junos	juniper junos	eq	12.1x44
juniper:srx100	juniper srx100	eq	-
juniper:srx110	juniper srx110	eq	-
juniper:srx1400	juniper srx1400	eq	-
juniper:srx210	juniper srx210	eq	-
juniper:srx220	juniper srx220	eq	-
juniper:srx240	juniper srx240	eq	-