Summary
Privilege Escalation in exclusive edit mode
Impact
Authenticated users with the ability to edit the configuration can bypass CLI restrictions.
Solution
New builds of Junos OS software are available from Juniper. As a workaround deny access to the 'load factory-default' command.
Insight
An escalation of privileges can occur when the 'load factory-default' command fails while in exclusive edit mode. When the load command fails, the user is no longer subject to any command and/or configuration restrictions. The escalation is limited to authenticated users with the ability to edit the configuration in the first place. The privilege bypass is specific to configured classes of CLI users with restrictions such as 'allow-commands', 'deny-commands', and 'deny-configuration'.
Affected
Junos OS 10.0, 10.4, 11.2, 11.3, 11.4 and 12.1.
Detection
Check the OS build.
References
Updated on 2015-03-25
