CVE-2019-0014 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC (Flexible PIC Concentrator) process which causes all interfaces to go down. By continuously sending the offending packet, an attacker can repeatedly crash the FPC process causing a sustained Denial of Service (DoS). This issue affects both IPv4 and IPv6 packet processing. Affected releases are Juniper Networks Junos OS on QFX and PTX Series: 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1; 18.2 versions prior to 18.2R1-S3, 18.2R2; 17.2X75 versions prior to 17.2X75-D91, 17.2X75-D100.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Juniper	Junos	17.2x75
Juniper	Ptx1000	-
Juniper	Ptx10002	-
Juniper	Ptx10008	-
Juniper	Ptx10016	-
Juniper	Ptx3000	-
Juniper	Ptx5000	-
Juniper	Qfx10002	-
Juniper	Qfx10008	-
Juniper	Qfx10016	-
Juniper	Qfx3500	-
Juniper	Qfx3600	-
Juniper	Qfx5100	-
Juniper	Qfx5110	-
Juniper	Qfx5120	-
Juniper	Qfx5200	-
Juniper	Qfx5210	-

Related Weaknesses (CWE)

CWE-19

References

http://www.securityfocus.com/bid/106556Third Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10914MitigationPatchVendor Advisory
http://www.securityfocus.com/bid/106556Third Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10914MitigationPatchVendor Advisory

FAQ

What is CVE-2019-0014?

CVE-2019-0014 is a vulnerability with a CVSS score of 7.5 (HIGH). On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC (Flexible PIC Concentrator) process which causes all interfaces to go down. By continuously sending the off...

How severe is CVE-2019-0014?

CVE-2019-0014 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-0014?

Check the references section above for vendor advisories and patch information. Affected products include: Juniper Junos, Juniper Ptx1000, Juniper Ptx10002, Juniper Ptx10008, Juniper Ptx10016.