CVE-2019-0007

EPSS 0.5%
Published 15.01.2019 21:29:01
Last modified 21.11.2024 04:16:02
Source sirt@juniper.net
Teams watchlist Login
Open Login

The vMX Series software uses a predictable IP ID Sequence Number. This leaves the system as well as clients connecting through the device susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of attack. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F5 on vMX Series.

Affected products Warnungen 0 Metrics 4 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Juniper ≫ Junos Version15.1

   Juniper ≫ Mx10 Version-
   Juniper ≫ Mx10003 Version-
   Juniper ≫ Mx10008 Version-
   Juniper ≫ Mx104 Version-
   Juniper ≫ Mx150 Version-
   Juniper ≫ Mx2008 Version-
   Juniper ≫ Mx2010 Version-
   Juniper ≫ Mx2020 Version-
   Juniper ≫ Mx204 Version-
   Juniper ≫ Mx240 Version-
   Juniper ≫ Mx40 Version-
   Juniper ≫ Mx480 Version-
   Juniper ≫ Mx5 Version-
   Juniper ≫ Mx80 Version-
   Juniper ≫ Mx960 Version-
   Juniper ≫ Vmx Version-

Juniper ≫ Junos Version15.1 Updatef1

Juniper ≫ Junos Version15.1 Updatef2

Juniper ≫ Junos Version15.1 Updatef3

Juniper ≫ Junos Version15.1 Updatef4

Juniper ≫ Junos Version15.1 Updatef5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.5%	0.632

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	10	3.9	6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
sirt@juniper.net	9.3	3.9	4.7	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H

CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

http://www.securityfocus.com/bid/106564

Third Party Advisory

VDB Entry

https://kb.juniper.net/JSA10903

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-0007

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-0007

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-0007

EUVD