CVE-2019-0007

EPSS 1.73%
Veröffentlicht 15.01.2019 21:29:01
Zuletzt bearbeitet 21.11.2024 04:16:02
Erkennungen
Login

Junos OS: vMX series: Predictable IP ID sequence numbers vulnerability

The vMX Series software uses a predictable IP ID Sequence Number. This leaves the system as well as clients connecting through the device susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of attack. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F5 on vMX Series.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 5

NVD 6 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Juniper ≫ Junos Version 15.1

   Juniper ≫ Mx10 Version -
   Juniper ≫ Mx10003 Version -
   Juniper ≫ Mx10008 Version -
   Juniper ≫ Mx104 Version -
   Juniper ≫ Mx150 Version -
   Juniper ≫ Mx2008 Version -
   Juniper ≫ Mx2010 Version -
   Juniper ≫ Mx2020 Version -
   Juniper ≫ Mx204 Version -
   Juniper ≫ Mx240 Version -
   Juniper ≫ Mx40 Version -
   Juniper ≫ Mx480 Version -
   Juniper ≫ Mx5 Version -
   Juniper ≫ Mx80 Version -
   Juniper ≫ Mx960 Version -
   Juniper ≫ Vmx Version -

Juniper ≫ Junos Version 15.1 Update f1

Juniper ≫ Junos Version 15.1 Update f2

Juniper ≫ Junos Version 15.1 Update f3

Juniper ≫ Junos Version 15.1 Update f4

Juniper ≫ Junos Version 15.1 Update f5

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.73%	0.746

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	10	3.9	6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
Juniper	9.3	3.9	4.7	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H

CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

http://www.securityfocus.com/bid/106564

Third Party Advisory

VDB Entry

https://kb.juniper.net/JSA10903

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-0007

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-0007

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-0007

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2019-0007