Junos OS: Insufficient validation of environment variables in telnet client may lead to stack-based buffer overflow
Published Jul 11, 2019
7.8
HIGHCVSS 3.1
EPSS 0.59%
Description
Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-based overflow is present in the handling of environment variables when connecting via the telnet client to remote telnet servers. This issue only affects the telnet client — accessible from the CLI or shell — in Junos OS. Inbound telnet services are not affected by this issue. This issue affects: Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D237, 15.1X53-D496, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S11, 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S6, 17.4R2-S3, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R1-S5, 18.2R2-S2, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2.
Affected products
-
- Version 12.3 versions prior to 12.3R12-S13StatusaffectedConstraints-
- Version 12.3X48 versions prior to 12.3X48-D80StatusaffectedConstraints-
- Version 14.1X53 versions prior to 14.1X53-D130 and 14.1X53-D49StatusaffectedConstraints-
- Version 15.1 versions prior to 15.1F6-S12 and15.1R7-S4StatusaffectedConstraints-
- Version 15.1X49 versions prior to 15.1X49-D170StatusaffectedConstraints-
- Version 15.1X53 versions prior to 15.1X53-D237 and 15.1X53-D496 and 15.1X53-D591 and 15.1X53-D69StatusaffectedConstraints-
- Version 16.1 versions prior to 16.1R3-S11 and 16.1R7-S4StatusaffectedConstraints-
- Version 16.2 versions prior to 16.2R2-S9StatusaffectedConstraints-
- Version 17.1 versions prior to 17.1R3StatusaffectedConstraints-
- Version 17.2 versions prior to 17.2R1-S8 and 17.2R2-S7 and 17.2R3-S1StatusaffectedConstraints-
- Version 17.3 versions prior to 17.3R3-S4StatusaffectedConstraints-
- Version 17.4 versions prior to 17.4R1-S6 and 17.4R2-S3 and 17.4R3StatusaffectedConstraints-
- Version 18.1 versions prior to 18.1R2-S4 and 18.1R3-S3StatusaffectedConstraints-
- Version 18.2 versions prior to 18.2R1-S5 and 18.2R2-S2 and 18.2R3StatusaffectedConstraints-
- Version 18.2X75 versions prior to 18.2X75-D40StatusaffectedConstraints-
- Version 18.3 versions prior to 18.3R1-S3 and 18.3R2StatusaffectedConstraints-
- Version 18.4 versions prior to 18.4R1-S2 and 18.4R2StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Juniper Networks | Junos OS | n/a |
|
Configuration 1
- 12.3
- 12.3
- 12.3
- 12.3
- 12.3
- 12.3
- 12.3
- 12.3
- 12.3
- 12.3
- 12.3
- 12.3
- 12.3
- 12.3r12
Configuration 2
- 12.3x48
- 12.3x48
- 12.3x48
- 12.3x48
- 12.3x48
- 12.3x48
- 12.3x48
- 12.3x48
- 12.3x48
- 12.3x48
- 12.3x48
- 12.3x48
- 12.3x48
Configuration 3
- 14.1x53
- 14.1x53
- 14.1x53
- 14.1x53
- 14.1x53
- 14.1x53
- 14.1x53
- 14.1x53
- 14.1x53
- 14.1x53
- 14.1x53
- 14.1x53
Configuration 4
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
- 15.1
Configuration 5
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
- 15.1x49
Configuration 6
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
- 15.1x53
Configuration 7
Configuration 8
Configuration 9
Configuration 10
Configuration 11
Configuration 12
Configuration 13
Configuration 14
Configuration 16
Configuration 18
- 10.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
The following software releases have been updated to resolve this specific issue: 12.3R12-S13, 12.3X48-D80, 12.3X48-D85, 14.1X53-D130, 14.1X53-D49, 15.1F6-S12, 15.1R7-S4, 15.1X49-D170, 15.1X53-D237, 15.1X53-D496, 15.1X53-D591, 15.1X53-D69, 16.1R3-S11, 16.1R7-S4, 16.2R2-S9, 17.1R3, 17.2R1-S8, 17.2R2-S7, 17.2R3-S1, 17.3R3-S4, 17.4R1-S6, 17.4R2-S3, 17.4R3, 18.1R2-S4, 18.1R3-S3, 18.2R1-S5, 18.2R2-S2, 18.2R3, 18.2X75-D40, 18.3R1-S3, 18.3R2, 18.4R1-S2, 18.4R2, 19.1R1, and all subsequent releases.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L/AC:L/Au:N/C:P/I:P/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (24 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 0.59% (0.00587) | 46.16th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.59% (0.00587) | 43.23th | v5 (v2026.06.15) |
| Mar 30, 2025 | 0.10% (0.00105) | 25.64th | v4 (v2025.03.14) |
| Mar 29, 2025 | 1.44% (0.01439) | 68.76th | v4 (v2025.03.14) |
| Mar 28, 2025 | 0.10% (0.00105) | 25.69th | v4 (v2025.03.14) |
| Mar 27, 2025 | 1.44% (0.01439) | 78.40th | v4 (v2025.03.14) |
| Mar 20, 2025 | 0.10% (0.00105) | 25.86th | v4 (v2025.03.14) |
| Mar 19, 2025 | 1.44% (0.01439) | 78.59th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.10% (0.00105) | 26.23th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.34% (0.00338) | 72.20th | v3 (v2023.03.01) |
| Jul 4, 2024 | 0.34% (0.00338) | 71.55th | v3 (v2023.03.01) |
| Jun 1, 2024 | 0.26% (0.00261) | 65.83th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.27% (0.00267) | 66.71th | v3 (v2023.03.01) |
| Oct 9, 2023 | 0.27% (0.00267) | 63.81th | v3 (v2023.03.01) |
| Sep 5, 2023 | 0.19% (0.00195) | 56.60th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.20% (0.00203) | 56.43th | v3 (v2023.03.01) |
| Mar 6, 2023 | 2.53% (0.02526) | 81.88th | v2 (v2022.01.01) |
| Nov 26, 2022 | 2.53% (0.02526) | 81.38th | v2 (v2022.01.01) |
| Apr 1, 2022 | 2.19% (0.02189) | 79.16th | v2 (v2022.01.01) |
| Feb 4, 2022 | 2.40% (0.02405) | 58.41th | v2 (v2022.01.01) |
| Feb 3, 2022 | 5.36% (0.05363) | 79.74th | v1 |
| Jan 6, 2022 | 5.36% (0.05363) | 79.54th | v1 |
| Sep 1, 2021 | 5.36% (0.05363) | 88.35th | v1 |
| Apr 14, 2021 | 5.36% (0.05363) | 0.00th | v1 |
References (7)
- http://packetstormsecurity.com/files/153746/FreeBSD-Security-Advisory-FreeBSD-SA-19-12.telnet.html Third Party AdvisoryVDB Entry
- https://kb.juniper.net/JSA10947 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html mailing-listIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html mailing-list
- https://seclists.org/bugtraq/2019/Jul/45 mailing-listMailing ListThird Party Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-19:12.telnet.asc vendor-advisoryThird Party Advisory
- https://www.exploit-db.com/exploits/45982 ExploitThird Party AdvisoryVDB Entry
| Link | Providers | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/153746/FreeBSD-Security-Advisory-FreeBSD-SA-19-12.telnet.html | Third Party AdvisoryVDB Entry | |
| https://kb.juniper.net/JSA10947 | Vendor Advisory | |
| https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html | mailing-listIssue TrackingThird Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html | mailing-list | |
| https://seclists.org/bugtraq/2019/Jul/45 | mailing-listMailing ListThird Party Advisory | |
| https://security.FreeBSD.org/advisories/FreeBSD-SA-19:12.telnet.asc | vendor-advisoryThird Party Advisory | |
| https://www.exploit-db.com/exploits/45982 | ExploitThird Party AdvisoryVDB Entry |
Change history (0)
No recorded changes yet.