CVE-2019-0003 — MEDIUM (5.9)

Vulnerability Description

When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon (rpd) process to crash with a core file being generated. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 15.1 versions prior to 15.1R3; 15.1F versions prior to 15.1F3; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400.

CVSS Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Juniper	Junos	12.1x46
Juniper	Srx100	-
Juniper	Srx110	-
Juniper	Srx1400	-
Juniper	Srx1500	-
Juniper	Srx210	-
Juniper	Srx220	-
Juniper	Srx240	-
Juniper	Srx300	-
Juniper	Srx320	-
Juniper	Srx340	-
Juniper	Srx3400	-
Juniper	Srx345	-
Juniper	Srx3600	-
Juniper	Srx4100	-
Juniper	Srx4200	-
Juniper	Srx5400	-
Juniper	Srx550	-
Juniper	Srx5600	-
Juniper	Srx5800	-

Related Weaknesses (CWE)

CWE-617

References

http://www.securityfocus.com/bid/106544Third Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10902Vendor Advisory
http://www.securityfocus.com/bid/106544Third Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10902Vendor Advisory

FAQ

What is CVE-2019-0003?

CVE-2019-0003 is a vulnerability with a CVSS score of 5.9 (MEDIUM). When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, ca...

How severe is CVE-2019-0003?

CVE-2019-0003 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-0003?

Check the references section above for vendor advisories and patch information. Affected products include: Juniper Junos, Juniper Srx100, Juniper Srx110, Juniper Srx1400, Juniper Srx1500.