Sign-up

ID

VAR-201904-1567


CVE

CVE-2019-0028


TITLE

Juniper Networks Junos OS Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-003438

DESCRIPTION

On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the local routing protocol daemon (RPD) process to crash and restart. By simulating a specific BGP session restart, an attacker can repeatedly crash the RPD process causing prolonged denial of service (DoS). Graceful restart helper mode for BGP is enabled by default. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R2-S8; 17.1 versions prior to 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.2X75 versions prior to 17.2X75-D92, 17.2X75-D102, 17.2X75-D110; 17.3 versions prior to 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 18.1 versions prior to 18.1R2. Junos OS releases prior to 16.1R1 are not affected. Juniper Networks Junos OS Contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Juniper Junos is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition, effectively denying service to legitimate users. The operating system provides a secure programming interface and Junos SDK

Trust: 2.07

sources: NVD: CVE-2019-0028 // JVNDB: JVNDB-2019-003438 // BID: 107892 // VULHUB: VHN-140059 // VULMON: CVE-2019-0028

AFFECTED PRODUCTS

vendor:junipermodel:junosscope:eqversion:18.1

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:17.4

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:17.3

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:17.2x75

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:17.2

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:17.1

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:16.2

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:16.1x65

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:16.1

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:17.2r3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.3r3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.1r3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.4r2

Trust: 1.0

vendor:junipermodel:junos osscope: - version: -

Trust: 0.8

vendor:junipermodel:junos 18.1r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r1-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.3r2-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.3r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.3r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.2x75-d91scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.2x75-d70scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.2x75-d50scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.2r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.2r1-s5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.2r1-s3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.2r1-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.2r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.1r2-s6scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.1r2-s5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.1r2-s4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.1r2-s3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.1r2-s2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.1r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.1r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 16.2r2-s7scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 16.2r2-s6scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 16.2r2-s5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 16.2r2-s2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 16.1x65-d47scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 16.1x65-d45scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 16.1r6scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 16.1r5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 16.1r3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 16.1r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 16.1r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 18.1r2scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.4r2scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.4r1-s4scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.3r3scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.3r2-s2scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.2x75-d92scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.2x75-d110scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.2x75-d102scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.2r3scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.2r1-s7scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.1r3scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.1r2-s7scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 16.2r2-s8scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 16.1x65-d48scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 16.1r7scope:neversion: -

Trust: 0.3

sources: BID: 107892 // JVNDB: JVNDB-2019-003438 // NVD: CVE-2019-0028

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-0028
value: HIGH

Trust: 1.0

sirt@juniper.net: CVE-2019-0028
value: HIGH

Trust: 1.0

NVD: CVE-2019-0028
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201904-564
value: HIGH

Trust: 0.6

VULHUB: VHN-140059
value: MEDIUM

Trust: 0.1

VULMON: CVE-2019-0028
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-0028
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-140059
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sirt@juniper.net: CVE-2019-0028
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2019-0028
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-140059 // VULMON: CVE-2019-0028 // JVNDB: JVNDB-2019-003438 // CNNVD: CNNVD-201904-564 // NVD: CVE-2019-0028 // NVD: CVE-2019-0028

PROBLEMTYPE DATA

problemtype:CWE-404

Trust: 1.0

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-20

Trust: 0.9

sources: VULHUB: VHN-140059 // JVNDB: JVNDB-2019-003438 // NVD: CVE-2019-0028

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201904-564

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201904-564

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-003438

PATCH
title:JSA10932url:https://kb.juniper.net/JSA10932
Trust: 0.8
title:Juniper Networks Junos OS Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=91379
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-003438 // 
            
            
            
            CNNVD: CNNVD-201904-564

EXTERNAL IDS
db:NVDid:CVE-2019-0028
Trust: 2.9
db:BIDid:107892
Trust: 2.1
db:JUNIPERid:JSA10932
Trust: 2.1
db:JVNDBid:JVNDB-2019-003438
Trust: 0.8
db:CNNVDid:CNNVD-201904-564
Trust: 0.7
db:VULHUBid:VHN-140059
Trust: 0.1
db:VULMONid:CVE-2019-0028
Trust: 0.1
sources:
            
            
            VULHUB: VHN-140059 // 
            
            
            
            VULMON: CVE-2019-0028 // 
            
            
            
            BID: 107892 // 
            
            
            
            JVNDB: JVNDB-2019-003438 // 
            
            
            
            CNNVD: CNNVD-201904-564 // 
            
            
            
            NVD: CVE-2019-0028

REFERENCES
url:http://www.securityfocus.com/bid/107892
Trust: 2.5
url:https://kb.juniper.net/jsa10932
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-0028
Trust: 1.4
url:http://www.juniper.net/us/en/products-services/nos/junos/
Trust: 0.9
url:https://kb.juniper.net/infocenter/index?page=content&id=jsa10932&cat=sirt_1&actp=list
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0028
Trust: 0.8
url:https://vigilance.fr/vulnerability/junos-os-denial-of-service-via-bgp-peer-restarts-29021
Trust: 0.6
url:http://www.juniper.net/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/20.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULHUB: VHN-140059 // 
            
            
            
            VULMON: CVE-2019-0028 // 
            
            
            
            BID: 107892 // 
            
            
            
            JVNDB: JVNDB-2019-003438 // 
            
            
            
            CNNVD: CNNVD-201904-564 // 
            
            
            
            NVD: CVE-2019-0028

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 107892

SOURCES
db:VULHUBid:VHN-140059
db:VULMONid:CVE-2019-0028
db:BIDid:107892
db:JVNDBid:JVNDB-2019-003438
db:CNNVDid:CNNVD-201904-564
db:NVDid:CVE-2019-0028

LAST UPDATE DATE
2024-11-23T21:37:25.055000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-140059date:2020-07-22T00:00:00
db:VULMONid:CVE-2019-0028date:2020-07-22T00:00:00
db:BIDid:107892date:2019-04-10T00:00:00
db:JVNDBid:JVNDB-2019-003438date:2019-05-16T00:00:00
db:CNNVDid:CNNVD-201904-564date:2021-10-29T00:00:00
db:NVDid:CVE-2019-0028date:2024-11-21T04:16:04.947

SOURCES RELEASE DATE
db:VULHUBid:VHN-140059date:2019-04-10T00:00:00
db:VULMONid:CVE-2019-0028date:2019-04-10T00:00:00
db:BIDid:107892date:2019-04-10T00:00:00
db:JVNDBid:JVNDB-2019-003438date:2019-05-16T00:00:00
db:CNNVDid:CNNVD-201904-564date:2019-04-10T00:00:00
db:NVDid:CVE-2019-0028date:2019-04-10T20:29:00.460