CVE-2019-0041 - Vulnerability Details - OpenCVE

On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Juniper	Ex4300-mp Junos

Configuration 1 [-]

AND

OR	cpe:2.3:o:juniper:junos:18.2:-::::::
	cpe:2.3:o:juniper:junos:18.2:r1::::::

cpe:2.3:h:juniper:ex4300-mp:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://kb.juniper.net/JSA10933

History

No history.

MITRE

Status: PUBLISHED

Assigner: juniper

Published: 2019-04-10T20:13:51.547199Z

Updated: 2024-09-16T18:08:50.199Z

Reserved: 2018-10-11T00:00:00

Link: CVE-2019-0041

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-04-10T20:29:00.943

Modified: 2024-11-21T04:16:06.750

Link: CVE-2019-0041

Redhat

No data.

{"containers": {"cna": {"affected": [{"platforms": ["EX4300-MP Series"], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [{"lessThan": "18.2R1-S2, 18.2R2", "status": "affected", "version": "18.2", "versionType": "custom"}]}], "configurations": [{"lang": "en", "value": "This issue requires filters configured on lo0."}], "datePublic": "2019-04-10T00:00:00", "descriptions": [{"lang": "en", "value": "On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices."}], "exploits": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-04-10T20:13:51", "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://kb.juniper.net/JSA10933"}], "solutions": [{"lang": "en", "value": "The following software releases have been updated to resolve this specific issue: 18.2R1-S2, 18.2R2, 18.3R1, and all subsequent releases."}], "source": {"advisory": "JSA10933", "defect": ["1379328"], "discovery": "INTERNAL"}, "title": "Junos OS: EX4300-MP Series: IP transit traffic can reach the control plane via loopback interface.", "workarounds": [{"lang": "en", "value": "Removing lo0 filters would mitigate this issue."}], "x_generator": {"engine": "Vulnogram 0.0.6"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "sirt@juniper.net", "DATE_PUBLIC": "2019-04-10T16:00:00.000Z", "ID": "CVE-2019-0041", "STATE": "PUBLIC", "TITLE": "Junos OS: EX4300-MP Series: IP transit traffic can reach the control plane via loopback interface."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Junos OS", "version": {"version_data": [{"platform": "EX4300-MP Series", "version_affected": "<", "version_name": "18.2", "version_value": "18.2R1-S2, 18.2R2"}]}}]}, "vendor_name": "Juniper Networks"}]}}, "configuration": [{"lang": "en", "value": "This issue requires filters configured on lo0."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices."}]}, "exploit": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "generator": {"engine": "Vulnogram 0.0.6"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284: Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://kb.juniper.net/JSA10933", "refsource": "CONFIRM", "url": "https://kb.juniper.net/JSA10933"}]}, "solution": [{"lang": "en", "value": "The following software releases have been updated to resolve this specific issue: 18.2R1-S2, 18.2R2, 18.3R1, and all subsequent releases."}], "source": {"advisory": "JSA10933", "defect": ["1379328"], "discovery": "INTERNAL"}, "work_around": [{"lang": "en", "value": "Removing lo0 filters would mitigate this issue."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T17:37:07.441Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://kb.juniper.net/JSA10933"}]}]}, "cveMetadata": {"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "assignerShortName": "juniper", "cveId": "CVE-2019-0041", "datePublished": "2019-04-10T20:13:51.547199Z", "dateReserved": "2018-10-11T00:00:00", "dateUpdated": "2024-09-16T18:08:50.199Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:18.2:-:*:*:*:*:*:*", "matchCriteriaId": "A8B5BD93-3C11-45D5-ACF0-7C4C01106C8A", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:18.2:r1:*:*:*:*:*:*", "matchCriteriaId": "167EEC4F-729E-47C2-B0F8-E8108CE3E985", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex4300-mp:-:*:*:*:*:*:*:*", "matchCriteriaId": "F9EECCB3-37B3-4146-8F8C-4BBFF84499E9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices."}, {"lang": "es", "value": "En los dispositivos de la serie EX4300-MP con cualquier filtro lo0 aplicado, el tr\u00e1fico de la red de tr\u00e1nsito puede alcanzar el plano de control por medio de la interfaz de bucle invertido (lo0). El dispositivo puede no reenviar dicho tr\u00e1fico. Este problema afecta a Juniper Networks Junos OS versi\u00f3n 18.2 y versiones anteriores a 18.2R1-S2, 18.2R2 en la serie EX4300-MP. Este problema no afecta a ning\u00fan otro dispositivo de la serie EX."}], "id": "CVE-2019-0041", "lastModified": "2024-11-21T04:16:06.750", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "sirt@juniper.net", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-04-10T20:29:00.943", "references": [{"source": "sirt@juniper.net", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://kb.juniper.net/JSA10933"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://kb.juniper.net/JSA10933"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "sirt@juniper.net", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}