Details of VAR-201904-1498

ID

VAR-201904-1498

CVE

CVE-2019-0036

TITLE

Juniper Networks Junos OS Vulnerabilities related to security functions

Trust: 0.8

sources: JVNDB: JVNDB-2019-003436

DESCRIPTION

When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g. "internal-1", "internal-2", etc.) are silently ignored. No warning is issued during configuration, and the config is committed without error, but the filter criteria will match all packets leading to unexpected results. Affected releases are Juniper Networks Junos OS: All versions prior to and including 12.3; 14.1X53 versions prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D161, 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D496, 15.1X53-D69; 16.1 versions prior to 16.1R7-S4, 16.1R7-S5; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S7, 17.4R2-S3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S4; 18.2 versions prior to 18.2R1-S5, 18.2R2-S1; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3; 18.4 versions prior to 18.4R1-S1, 18.4R1-S2. Juniper Networks Junos OS Contains vulnerabilities related to security features.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Juniper Networks Junos OS is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware equipment. The operating system provides a secure programming interface and Junos SDK. A security signature issue vulnerability exists in Juniper Networks Junos OS. This vulnerability is due to the lack of security measures such as authentication, access control, and rights management in network systems or products

Trust: 1.8

sources: NVD: CVE-2019-0036 // JVNDB: JVNDB-2019-003436 // VULHUB: VHN-140067 // VULMON: CVE-2019-0036

AFFECTED PRODUCTS

vendor:	juniper	model:	junos	scope:	eq	version:	17.3	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	18.1	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1f6-s6	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	18.2	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	14.1x53	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1f6-s10	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1f6-s8	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1f6-s9	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1f6-s11	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	16.1	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	18.2x75	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	18.4	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	17.2	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1f6-s1	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1x53	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	18.3	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1f6-s4	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	17.4	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1f6-s5	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1f6-s2	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1x49	Trust: 1.0
vendor:	juniper	model:	junos	scope:	lte	version:	12.3	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1f6-s7	Trust: 1.0
vendor:	juniper	model:	junos os	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2019-003436 // NVD: CVE-2019-0036

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-0036
value:	CRITICAL
Trust: 1.0
sirt@juniper.net:	CVE-2019-0036
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-0036
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201904-554
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-140067
value:	HIGH
Trust: 0.1
VULMON:	CVE-2019-0036
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-0036
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-140067
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-0036
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
sirt@juniper.net:	CVE-2019-0036
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.7
version:	3.0
Trust: 1.0
NVD:	CVE-2019-0036
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-140067 // VULMON: CVE-2019-0036 // JVNDB: JVNDB-2019-003436 // CNNVD: CNNVD-201904-554 // NVD: CVE-2019-0036 // NVD: CVE-2019-0036

PROBLEMTYPE DATA

problemtype:	CWE-754	Trust: 1.1
problemtype:	CWE-284	Trust: 1.0
problemtype:	CWE-254	Trust: 0.9

sources: VULHUB: VHN-140067 // JVNDB: JVNDB-2019-003436 // NVD: CVE-2019-0036

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201904-554

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-201904-554

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-003436

PATCH

title:	JSA10925	url:	https://kb.juniper.net/JSA10925	Trust: 0.8
title:	Juniper Networks Junos OS Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=91369	Trust: 0.6

sources: JVNDB: JVNDB-2019-003436 // CNNVD: CNNVD-201904-554

EXTERNAL IDS

db:	NVD	id:	CVE-2019-0036	Trust: 2.6
db:	JUNIPER	id:	JSA10925	Trust: 1.8
db:	JVNDB	id:	JVNDB-2019-003436	Trust: 0.8
db:	CNNVD	id:	CNNVD-201904-554	Trust: 0.7
db:	AUSCERT	id:	ESB-2019.1266	Trust: 0.6
db:	VULHUB	id:	VHN-140067	Trust: 0.1
db:	VULMON	id:	CVE-2019-0036	Trust: 0.1

sources: VULHUB: VHN-140067 // VULMON: CVE-2019-0036 // JVNDB: JVNDB-2019-003436 // CNNVD: CNNVD-201904-554 // NVD: CVE-2019-0036

REFERENCES

url:	https://kb.juniper.net/jsa10925	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2019-0036	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0036	Trust: 0.8
url:	http://kb.juniper.net/infocenter/index	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/78978	Trust: 0.6
url:	https://vigilance.fr/vulnerability/junos-os-privilege-escalation-via-internal-n-29014	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/754.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-140067 // VULMON: CVE-2019-0036 // JVNDB: JVNDB-2019-003436 // CNNVD: CNNVD-201904-554 // NVD: CVE-2019-0036

SOURCES

db:	VULHUB	id:	VHN-140067
db:	VULMON	id:	CVE-2019-0036
db:	JVNDB	id:	JVNDB-2019-003436
db:	CNNVD	id:	CNNVD-201904-554
db:	NVD	id:	CVE-2019-0036

LAST UPDATE DATE

2024-08-14T13:26:39.665000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-140067	date:	2020-09-29T00:00:00
db:	VULMON	id:	CVE-2019-0036	date:	2021-02-05T00:00:00
db:	JVNDB	id:	JVNDB-2019-003436	date:	2019-05-16T00:00:00
db:	CNNVD	id:	CNNVD-201904-554	date:	2020-10-28T00:00:00
db:	NVD	id:	CVE-2019-0036	date:	2021-02-05T16:48:54.243

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-140067	date:	2019-04-10T00:00:00
db:	VULMON	id:	CVE-2019-0036	date:	2019-04-10T00:00:00
db:	JVNDB	id:	JVNDB-2019-003436	date:	2019-05-16T00:00:00
db:	CNNVD	id:	CNNVD-201904-554	date:	2019-04-10T00:00:00
db:	NVD	id:	CVE-2019-0036	date:	2019-04-10T20:29:00.757