Details of VAR-201904-1547

ID

VAR-201904-1547

CVE

CVE-2019-0038

TITLE

Juniper Networks Junos OS Resource management vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-003433

DESCRIPTION

Crafted packets destined to the management interface (fxp0) of an SRX340 or SRX345 services gateway may create a denial of service (DoS) condition due to buffer space exhaustion. This issue only affects the SRX340 and SRX345 services gateways. No other products or platforms are affected by this vulnerability. Affected releases are Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D160 on SRX340/SRX345; 17.3 on SRX340/SRX345; 17.4 versions prior to 17.4R2-S3, 17.4R3 on SRX340/SRX345; 18.1 versions prior to 18.1R3-S1 on SRX340/SRX345; 18.2 versions prior to 18.2R2 on SRX340/SRX345; 18.3 versions prior to 18.3R1-S2, 18.3R2 on SRX340/SRX345. This issue does not affect Junos OS releases prior to 15.1X49 on any platform. Juniper Networks Junos OS Contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Juniper Junos is prone to a denial-of-service vulnerability. An attacker may exploit this issue to cause denial-of-service conditions. Both Juniper Networks SRX340 and Juniper Networks SRX345 are products of Juniper Networks (Juniper Networks). The Juniper Networks SRX340 is a 340 Series Secure Services Gateway appliance. The Juniper Networks SRX345 is a 345 Series Secure Services Gateway appliance. Junos OS is a set of network operating systems dedicated to the company's hardware devices. The following releases are affected: Junos OS Release 15.1X49, Release 17.3, Release 17.4, Release 18.1, Release 18.2, Release 18.3

Trust: 1.98

sources: NVD: CVE-2019-0038 // JVNDB: JVNDB-2019-003433 // BID: 107873 // VULHUB: VHN-140069

AFFECTED PRODUCTS

vendor:	juniper	model:	junos	scope:	eq	version:	18.3	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	18.2	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	18.1	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	17.4	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	17.3	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	15.1x49	Trust: 1.3
vendor:	juniper	model:	junos os	scope:	-	version:	-	Trust: 0.8
vendor:	juniper	model:	junos 18.3r1	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.2r1-s5	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.2r1-s4	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.2r1-s3	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.2r1	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.1r3	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.1r2-s4	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.1r2-s3	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.1r2-s2	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.1r2-s1	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.1r2	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.1r1	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 17.4r2-s2	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 17.4r2-s1	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 17.4r2	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 17.4r1-s6	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 17.4r1-s5	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 17.4r1-s4	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 17.4r1-s1	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 17.4r1	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d90	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d80	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d70	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d60	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d40	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d35	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d30	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d20	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d150	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d15	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d140	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d131	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d130	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d120	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d110	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d101	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d100	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d10	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.4r1	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.3r2	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.3r1-s2	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.2r2	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 18.1r3-s1	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 17.4r3	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 17.4r2-s3	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 15.1x49-d160	scope:	ne	version:	-	Trust: 0.3

sources: BID: 107873 // JVNDB: JVNDB-2019-003433 // NVD: CVE-2019-0038

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-0038
value:	MEDIUM
Trust: 1.0
sirt@juniper.net:	CVE-2019-0038
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-0038
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201904-552
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-140069
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-0038
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-140069
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sirt@juniper.net:	CVE-2019-0038
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2019-0038
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0

sources: VULHUB: VHN-140069 // JVNDB: JVNDB-2019-003433 // CNNVD: CNNVD-201904-552 // NVD: CVE-2019-0038 // NVD: CVE-2019-0038

PROBLEMTYPE DATA

problemtype:	CWE-770	Trust: 1.1
problemtype:	CWE-400	Trust: 1.0
problemtype:	CWE-399	Trust: 0.9

sources: VULHUB: VHN-140069 // JVNDB: JVNDB-2019-003433 // NVD: CVE-2019-0038

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201904-552

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201904-552

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-003433

PATCH

title:	JSA10927	url:	https://kb.juniper.net/JSA10927	Trust: 0.8
title:	Juniper Networks SRX340 and Juniper Networks SRX345 Junos OS Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=91367	Trust: 0.6

sources: JVNDB: JVNDB-2019-003433 // CNNVD: CNNVD-201904-552

EXTERNAL IDS

db:	NVD	id:	CVE-2019-0038	Trust: 2.8
db:	JUNIPER	id:	JSA10927	Trust: 2.0
db:	BID	id:	107873	Trust: 2.0
db:	JVNDB	id:	JVNDB-2019-003433	Trust: 0.8
db:	CNNVD	id:	CNNVD-201904-552	Trust: 0.7
db:	AUSCERT	id:	ESB-2019.1267	Trust: 0.6
db:	VULHUB	id:	VHN-140069	Trust: 0.1

sources: VULHUB: VHN-140069 // BID: 107873 // JVNDB: JVNDB-2019-003433 // CNNVD: CNNVD-201904-552 // NVD: CVE-2019-0038

REFERENCES

url:	http://www.securityfocus.com/bid/107873	Trust: 2.3
url:	https://kb.juniper.net/jsa10927	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-0038	Trust: 1.4
url:	http://www.juniper.net/us/en/products-services/nos/junos/	Trust: 0.9
url:	https://kb.juniper.net/infocenter/index?page=content&id=jsa10927&actp=rss	Trust: 0.9
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0038	Trust: 0.8
url:	http://kb.juniper.net/infocenter/index	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/78982	Trust: 0.6
url:	https://vigilance.fr/vulnerability/junos-os-srx-denial-of-service-via-fxp0-29016	Trust: 0.6
url:	http://www.juniper.net/	Trust: 0.3

sources: VULHUB: VHN-140069 // BID: 107873 // JVNDB: JVNDB-2019-003433 // CNNVD: CNNVD-201904-552 // NVD: CVE-2019-0038

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 107873

SOURCES

db:	VULHUB	id:	VHN-140069
db:	BID	id:	107873
db:	JVNDB	id:	JVNDB-2019-003433
db:	CNNVD	id:	CNNVD-201904-552
db:	NVD	id:	CVE-2019-0038

LAST UPDATE DATE

2024-08-14T14:19:34.939000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-140069	date:	2020-09-29T00:00:00
db:	BID	id:	107873	date:	2019-04-10T00:00:00
db:	JVNDB	id:	JVNDB-2019-003433	date:	2019-05-16T00:00:00
db:	CNNVD	id:	CNNVD-201904-552	date:	2020-09-30T00:00:00
db:	NVD	id:	CVE-2019-0038	date:	2021-10-25T16:21:47.820

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-140069	date:	2019-04-10T00:00:00
db:	BID	id:	107873	date:	2019-04-10T00:00:00
db:	JVNDB	id:	JVNDB-2019-003433	date:	2019-05-16T00:00:00
db:	CNNVD	id:	CNNVD-201904-552	date:	2019-04-10T00:00:00
db:	NVD	id:	CVE-2019-0038	date:	2019-04-10T20:29:00.820