CVE-2019-0008
CVSS V2 High 7.5
CVSS V3 Critical 9.8
Description
A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager (FXPC) process on QFX5000 series, EX4300, EX4600 devices. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. Affected releases are Juniper Networks Junos OS on QFX 5000 series, EX4300, EX4600 are: 14.1X53; 15.1X53 versions prior to 15.1X53-D235; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2, 17.3R4; 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1, 18.1R4; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R2.
Overview
- CVE ID
- CVE-2019-0008
- Assigner
- sirt@juniper.net
- Vulnerability Status
- Analyzed
- Published Version
- 2019-04-10T20:29:00
- Last Modified Date
- 2021-10-25T16:19:19
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | 1 | OR | 15.1x53 | 15.1x53-d235 |
| cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | 1 | OR | 17.1 | 17.1r3 |
| cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | 1 | OR | 17.2 | 17.2r3 |
| cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | 1 | OR | 17.3 | 17.3r3-s2 |
| cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | 1 | OR | 17.4 | 17.4r2-s1 |
| cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | 1 | OR | 18.1 | 18.1r3-s1 |
| cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | 1 | OR | 18.2 | 18.2r2 |
| cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | 1 | OR | 18.2x75 | 18.2x75-d30 |
| cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | 1 | OR | 18.3 | 18.3r2 |
| cpe:2.3:o:juniper:junos:14.1x53:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:juniper:junos:17.3:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:juniper:junos:17.4:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:juniper:junos:18.1:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:h:juniper:ex4300m:-:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:h:juniper:qfx5200-32c:-:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:h:juniper:qfx5200-48y:-:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:h:juniper:qfx5210-64c:-:*:*:*:*:*:*:* | 0 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 7.5
- Severity
- HIGH
- Exploitability Score
- 10
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 9.8
- Base Severity
- CRITICAL
- Exploitability Score
- 3.9
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://kb.juniper.net/JSA10930 | Vendor Advisory |
| http://www.securityfocus.com/bid/107897 | Third Party Advisory VDB Entry |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2019-0008 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0008 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 06:50:01 | Added to TrackCVE | |||
| 2022-12-03 19:30:30 | 2019-04-10T20:29Z | 2019-04-10T20:29:00 | CVE Published Date | updated |
| 2022-12-03 19:30:30 | 2021-10-25T16:19:19 | CVE Modified Date | updated | |
| 2022-12-03 19:30:30 | Analyzed | Vulnerability Status | updated |