Vulnerability CVE-2019-0006 - CERT Civis.Net

Vulnerability Name:

CVE-2019-0006 (CCN-155349)

Assigned:

2018-10-11

Published:

2019-01-09

Updated:

2021-10-28

Summary:

A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, QFX and MX Series devices in a Virtual Chassis configuration. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. This issue only occurs when the crafted packet it destined to the device. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47 on EX and QFX Virtual Chassis Platforms; 15.1 versions prior to 15.1R7-S3 all Virtual Chassis Platforms 15.1X53 versions prior to 15.1X53-D50 on EX and QFX Virtual Chassis Platforms.

CVSS v3 Severity:

9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2019-0006

Source: BID
Type: Third Party Advisory, VDB Entry
106666

Source: XF
Type: UNKNOWN
juniper-junos-cve20190006-code-exec(155349)

Source: CCN
Type: Juniper Networks Security Bulletin JSA10906
Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configuration (CVE-2019-0006)

Source: CONFIRM
Type: Vendor Advisory
https://kb.juniper.net/JSA10906

Vulnerable Configuration:

Configuration 1:

cpe:/o:juniper:junos:14.1x53:d25:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d27:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d46:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d10:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d15:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d30:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d35:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d40:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d45:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d16:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d26:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:r1:*:*:*:*:*:*

AND

cpe:/h:juniper:ex3300:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4200:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex8208:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex9204:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx10002:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx10016:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx3500:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex2200:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex2200-c:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex2300:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex9208:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex9214:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex9251:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex9253:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4300:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4500:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4550:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4600:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4650:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx5110:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx5200:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx5120:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx5210:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx3600:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex2300-c:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex3400:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex6210:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex8216:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx10008:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx5100:-:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:juniper:junos:15.1:r1:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1:r3:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1:r5:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1:r6:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1:r2:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1:r4:*:*:*:*:*:*

Configuration 3:

cpe:/o:juniper:junos:15.1x53:d21:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1x53:d32:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1x53:d33:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1x53:d34:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1x53:d50:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1x53:d20:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1x53:d30:*:*:*:*:*:*

AND

cpe:/h:juniper:ex9253:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex2200-c:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4500:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4600:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex9214:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx10002:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex2300-c:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex3300:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex3400:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4200:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx10008:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx10016:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx5100:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx5110:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx5200:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx5210:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex6210:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex8208:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex8216:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex9204:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx3500:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex2200:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex2300:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4300:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4550:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex4650:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex9208:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:ex9251:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx5120:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:qfx3600:-:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:juniper:junos:14.1x53:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1:*:*:*:*:*:*:*

OR cpe:/o:juniper:junos:15.1x53:*:*:*:*:*:*:*

Denotes that component is vulnerable