CVE-2019-0055

EPSS 1.35%
Veröffentlicht 09.10.2019 20:15:16
Zuletzt bearbeitet 21.11.2024 04:16:08
Erkennungen
Login

Junos OS: SRX Series: An attacker may cause flowd to crash by sending certain valid SIP traffic to a device with SIP ALG enabled.

A vulnerability in the SIP ALG packet processing service of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific types of valid SIP traffic to the device. In this case, the flowd process crashes and generates a core dump while processing SIP ALG traffic. Continued receipt of these valid SIP packets will result in a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D61, 12.3X48-D65 on SRX Series; 15.1X49 versions prior to 15.1X49-D130 on SRX Series; 17.3 versions prior to 17.3R3 on SRX Series; 17.4 versions prior to 17.4R2 on SRX Series.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 5

NVD 39 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Juniper ≫ Junos Version 12.3x48 Update d10

   Juniper ≫ Csrx Version -
   Juniper ≫ Srx100 Version -
   Juniper ≫ Srx110 Version -
   Juniper ≫ Srx1400 Version -
   Juniper ≫ Srx1500 Version -
   Juniper ≫ Srx210 Version -
   Juniper ≫ Srx220 Version -
   Juniper ≫ Srx240 Version -
   Juniper ≫ Srx300 Version -
   Juniper ≫ Srx320 Version -
   Juniper ≫ Srx340 Version -
   Juniper ≫ Srx3400 Version -
   Juniper ≫ Srx345 Version -
   Juniper ≫ Srx3600 Version -
   Juniper ≫ Srx4100 Version -
   Juniper ≫ Srx4200 Version -
   Juniper ≫ Srx4600 Version -
   Juniper ≫ Srx5400 Version -
   Juniper ≫ Srx550 Version -
   Juniper ≫ Srx550 Hm Version -
   Juniper ≫ Srx5600 Version -
   Juniper ≫ Srx5800 Version -
   Juniper ≫ Srx650 Version -
   Juniper ≫ Vsrx Version -

Juniper ≫ Junos Version 12.3x48 Update d15

Juniper ≫ Junos Version 12.3x48 Update d25

Juniper ≫ Junos Version 12.3x48 Update d30

Juniper ≫ Junos Version 12.3x48 Update d35

Juniper ≫ Junos Version 12.3x48 Update d40

Juniper ≫ Junos Version 12.3x48 Update d45

Juniper ≫ Junos Version 12.3x48 Update d50

Juniper ≫ Junos Version 12.3x48 Update d55

Juniper ≫ Junos Version 12.3x48 Update d60

Juniper ≫ Junos Version 15.1x49 Update -

Juniper ≫ Junos Version 15.1x49 Update d10

Juniper ≫ Junos Version 15.1x49 Update d100

Juniper ≫ Junos Version 15.1x49 Update d110

Juniper ≫ Junos Version 15.1x49 Update d120

Juniper ≫ Junos Version 15.1x49 Update d20

Juniper ≫ Junos Version 15.1x49 Update d30

Juniper ≫ Junos Version 15.1x49 Update d35

Juniper ≫ Junos Version 15.1x49 Update d40

Juniper ≫ Junos Version 15.1x49 Update d45

Juniper ≫ Junos Version 15.1x49 Update d50

Juniper ≫ Junos Version 15.1x49 Update d55

Juniper ≫ Junos Version 15.1x49 Update d60

Juniper ≫ Junos Version 15.1x49 Update d65

Juniper ≫ Junos Version 15.1x49 Update d70

Juniper ≫ Junos Version 15.1x49 Update d75

Juniper ≫ Junos Version 15.1x49 Update d80

Juniper ≫ Junos Version 15.1x49 Update d90

Juniper ≫ Junos Version 17.3 Update -

Juniper ≫ Junos Version 17.3 Update r2

Juniper ≫ Junos Version 17.3 Update r2-s1

Juniper ≫ Junos Version 17.3 Update r2-s2

Juniper ≫ Junos Version 17.4 Update -

Juniper ≫ Junos Version 17.4 Update r1

Juniper ≫ Junos Version 17.4 Update r1-s1

Juniper ≫ Junos Version 17.4 Update r1-s2

Juniper ≫ Junos Version 17.4 Update r1-s4

Juniper ≫ Junos Version 17.4 Update r1-s6

Juniper ≫ Junos Version 17.4 Update r1-s7

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.35%	0.678

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P
Juniper	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-130 Improper Handling of Length Parameter Inconsistency

The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

https://kb.juniper.net/JSA10953

Vendor Advisory

https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-sip-alg.html

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-0055

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-0055

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-0055

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2019-0055