CVE-2019-0006 — CRITICAL (9.8)

Vulnerability Description

A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, QFX and MX Series devices in a Virtual Chassis configuration. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. This issue only occurs when the crafted packet it destined to the device. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47 on EX and QFX Virtual Chassis Platforms; 15.1 versions prior to 15.1R7-S3 all Virtual Chassis Platforms 15.1X53 versions prior to 15.1X53-D50 on EX and QFX Virtual Chassis Platforms.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Juniper	Junos	14.1x53
Juniper	Ex2200	-
Juniper	Ex2200-C	-
Juniper	Ex2300	-
Juniper	Ex2300-C	-
Juniper	Ex3300	-
Juniper	Ex3400	-
Juniper	Ex4200	-
Juniper	Ex4300	-
Juniper	Ex4500	-
Juniper	Ex4550	-
Juniper	Ex4600	-
Juniper	Ex4650	-
Juniper	Ex6210	-
Juniper	Ex8208	-
Juniper	Ex8216	-
Juniper	Ex9204	-
Juniper	Ex9208	-
Juniper	Ex9214	-
Juniper	Ex9251	-

Related Weaknesses (CWE)

CWE-908

References

http://www.securityfocus.com/bid/106666Third Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10906Vendor Advisory
http://www.securityfocus.com/bid/106666Third Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10906Vendor Advisory

FAQ

What is CVE-2019-0006?

CVE-2019-0006 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, QFX and MX Series devices in a Virtual Cha...

How severe is CVE-2019-0006?

CVE-2019-0006 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2019-0006?

Check the references section above for vendor advisories and patch information. Affected products include: Juniper Junos, Juniper Ex2200, Juniper Ex2200-C, Juniper Ex2300, Juniper Ex2300-C.