CVE-2019-0006

EPSS 5.26%
Veröffentlicht 15.01.2019 21:29:01
Zuletzt bearbeitet 21.11.2024 04:16:01
Erkennungen
Login

Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configuration

A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, QFX and MX Series devices in a Virtual Chassis configuration. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. This issue only occurs when the crafted packet it destined to the device. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47 on EX and QFX Virtual Chassis Platforms; 15.1 versions prior to 15.1R7-S3 all Virtual Chassis Platforms 15.1X53 versions prior to 15.1X53-D50 on EX and QFX Virtual Chassis Platforms.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 5

NVD 26 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Juniper ≫ Junos Version 14.1x53

   Juniper ≫ Ex2200 Version -
   Juniper ≫ Ex2200-c Version -
   Juniper ≫ Ex2300 Version -
   Juniper ≫ Ex2300-c Version -
   Juniper ≫ Ex3300 Version -
   Juniper ≫ Ex3400 Version -
   Juniper ≫ Ex4200 Version -
   Juniper ≫ Ex4300 Version -
   Juniper ≫ Ex4500 Version -
   Juniper ≫ Ex4550 Version -
   Juniper ≫ Ex4600 Version -
   Juniper ≫ Ex4650 Version -
   Juniper ≫ Ex6210 Version -
   Juniper ≫ Ex8208 Version -
   Juniper ≫ Ex8216 Version -
   Juniper ≫ Ex9204 Version -
   Juniper ≫ Ex9208 Version -
   Juniper ≫ Ex9214 Version -
   Juniper ≫ Ex9251 Version -
   Juniper ≫ Ex9253 Version -
   Juniper ≫ Qfx10002 Version -
   Juniper ≫ Qfx10008 Version -
   Juniper ≫ Qfx10016 Version -
   Juniper ≫ Qfx3500 Version -
   Juniper ≫ Qfx3600 Version -
   Juniper ≫ Qfx5100 Version -
   Juniper ≫ Qfx5110 Version -
   Juniper ≫ Qfx5120 Version -
   Juniper ≫ Qfx5200 Version -
   Juniper ≫ Qfx5210 Version -

Juniper ≫ Junos Version 14.1x53 Update d10

Juniper ≫ Junos Version 14.1x53 Update d15

Juniper ≫ Junos Version 14.1x53 Update d16

Juniper ≫ Junos Version 14.1x53 Update d25

Juniper ≫ Junos Version 14.1x53 Update d26

Juniper ≫ Junos Version 14.1x53 Update d27

Juniper ≫ Junos Version 14.1x53 Update d30

Juniper ≫ Junos Version 14.1x53 Update d35

Juniper ≫ Junos Version 14.1x53 Update d40

Juniper ≫ Junos Version 14.1x53 Update d45

Juniper ≫ Junos Version 14.1x53 Update d46

Juniper ≫ Junos Version 14.1x53 Update r1

Juniper ≫ Junos Version 15.1 Update r1

Juniper ≫ Junos Version 15.1 Update r2

Juniper ≫ Junos Version 15.1 Update r3

Juniper ≫ Junos Version 15.1 Update r4

Juniper ≫ Junos Version 15.1 Update r5

Juniper ≫ Junos Version 15.1 Update r6

Juniper ≫ Junos Version 15.1x53 Update d20

Juniper ≫ Junos Version 15.1x53 Update d21

Juniper ≫ Junos Version 15.1x53 Update d30

Juniper ≫ Junos Version 15.1x53 Update d32

Juniper ≫ Junos Version 15.1x53 Update d33

Juniper ≫ Junos Version 15.1x53 Update d34

Juniper ≫ Junos Version 15.1x53 Update d50

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	5.26%	0.915

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
Juniper	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

http://www.securityfocus.com/bid/106666

Third Party Advisory

VDB Entry

https://kb.juniper.net/JSA10906

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-0006

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-0006

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-0006

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2019-0006