Sign-up

ID

VAR-201907-1598


CVE

CVE-2019-0052


TITLE

Juniper Networks Junos OS Vulnerable to resource exhaustion

Trust: 0.8

sources: JVNDB: JVNDB-2019-006813

DESCRIPTION

The srxpfe process may crash on SRX Series services gateways when the UTM module processes a specific fragmented HTTP packet. The packet is misinterpreted as a regular TCP packet which causes the processor to crash. This issue affects all SRX Series platforms that support URL-Filtering and have web-filtering enabled. Affected releases are Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D85 on SRX Series; 15.1X49 versions prior to 15.1X49-D181, 15.1X49-D190 on SRX Series; 17.3 versions on SRX Series; 17.4 versions prior to 17.4R1-S8, 17.4R2-S5, 17.4R3 on SRX Series; 18.1 versions prior to 18.1R3-S6 on SRX Series; 18.2 versions prior to 18.2R2-S1, 18.2R3 on SRX Series; 18.3 versions prior to 18.3R1-S2, 18.3R2 on SRX Series; 18.4 versions prior to 18.4R1-S1, 18.4R2 on SRX Series. Juniper Networks Junos OS Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Juniper Junos is prone to a denial-of-service vulnerability. An attacker may exploit this issue to cause denial-of-service conditions. Juniper Networks Junos OS is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware equipment. The operating system provides a secure programming interface and Junos SDK. A security vulnerability exists in Juniper Networks Junos OS (SRX Series). The following products and versions are affected: Juniper Networks Junos OS Release 12.3X48, Release 15.1X49, Release 17.3, Release 17.4, Release 18.1, Release 18.2, Release 18.3, Release 18.4

Trust: 1.98

sources: NVD: CVE-2019-0052 // JVNDB: JVNDB-2019-006813 // BID: 109145 // VULHUB: VHN-140083

AFFECTED PRODUCTS

vendor:junipermodel:junosscope:eqversion:18.4

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:18.3

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:18.2

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:18.1

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:17.4

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:17.3

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:15.1x49

Trust: 1.3

vendor:junipermodel:junosscope:eqversion:12.3x48

Trust: 1.3

vendor:junipermodel:junos osscope: - version: -

Trust: 0.8

vendor:junipermodel:junos 18.3r1-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 18.3r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 18.2r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 18.2r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 18.1r3-s4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 18.1r3-s3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 18.1r3-s2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 18.1r3-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r2-s4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r2-s3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r2-s2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r2-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r1-s7scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r1-s6scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r1-s5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r1-s4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r1-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 17.4r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d90scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d80scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d70scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d60scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d40scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d35scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d30scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d20scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d180scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d171scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d160scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d150scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d140scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d131scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d130scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d120scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d110scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d101scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d100scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d80scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d77scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d76scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d75scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d70scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d66scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d60scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d55scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d51scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d50scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d45scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d40scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d35scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d30scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d25scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d20scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d15scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d10scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 18.4r2scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 18.4r1-s1scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 18.3r2scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 18.3r1-s2scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 18.2r3scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 18.2r2-s1scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 18.1r3-s6scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.4r3scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.4r2-s5scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.4r1-s8scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d190scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d181scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d85scope:neversion: -

Trust: 0.3

sources: BID: 109145 // JVNDB: JVNDB-2019-006813 // NVD: CVE-2019-0052

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-0052
value: HIGH

Trust: 1.0

sirt@juniper.net: CVE-2019-0052
value: HIGH

Trust: 1.0

NVD: CVE-2019-0052
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201907-625
value: HIGH

Trust: 0.6

VULHUB: VHN-140083
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-0052
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-140083
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sirt@juniper.net: CVE-2019-0052
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2019-0052
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-140083 // JVNDB: JVNDB-2019-006813 // CNNVD: CNNVD-201907-625 // NVD: CVE-2019-0052 // NVD: CVE-2019-0052

PROBLEMTYPE DATA

problemtype:CWE-436

Trust: 1.1

problemtype:CWE-404

Trust: 1.0

problemtype:CWE-400

Trust: 0.9

sources: VULHUB: VHN-140083 // JVNDB: JVNDB-2019-006813 // NVD: CVE-2019-0052

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201907-625

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201907-625

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-006813

PATCH
title:JSA10946url:https://kb.juniper.net/JSA10946
Trust: 0.8
title:Juniper Networks Junos OS Security hole 	 Repair measuresurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=95169
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-006813 // 
            
            
            
            CNNVD: CNNVD-201907-625

EXTERNAL IDS
db:NVDid:CVE-2019-0052
Trust: 2.8
db:JUNIPERid:JSA10946
Trust: 2.0
db:BIDid:109145
Trust: 2.0
db:JVNDBid:JVNDB-2019-006813
Trust: 0.8
db:CNNVDid:CNNVD-201907-625
Trust: 0.7
db:AUSCERTid:ESB-2019.2560
Trust: 0.6
db:VULHUBid:VHN-140083
Trust: 0.1
sources:
            
            
            VULHUB: VHN-140083 // 
            
            
            
            BID: 109145 // 
            
            
            
            JVNDB: JVNDB-2019-006813 // 
            
            
            
            CNNVD: CNNVD-201907-625 // 
            
            
            
            NVD: CVE-2019-0052

REFERENCES
url:http://www.securityfocus.com/bid/109145
Trust: 1.7
url:https://kb.juniper.net/jsa10946
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-0052
Trust: 1.4
url:http://www.juniper.net/us/en/products-services/nos/junos/
Trust: 0.9
url:https://kb.juniper.net/infocenter/index?page=content&id=jsa10946&cat=sirt_1&actp=list&showdraft=false
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0052
Trust: 0.8
url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10946
Trust: 0.6
url:https://vigilance.fr/vulnerability/junos-os-srx-denial-of-service-via-fragmented-http-packet-29744
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.2560/
Trust: 0.6
url:http://www.juniper.net/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-140083 // 
            
            
            
            BID: 109145 // 
            
            
            
            JVNDB: JVNDB-2019-006813 // 
            
            
            
            CNNVD: CNNVD-201907-625 // 
            
            
            
            NVD: CVE-2019-0052

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 109145

SOURCES
db:VULHUBid:VHN-140083
db:BIDid:109145
db:JVNDBid:JVNDB-2019-006813
db:CNNVDid:CNNVD-201907-625
db:NVDid:CVE-2019-0052

LAST UPDATE DATE
2024-08-14T14:19:26.088000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-140083date:2020-09-29T00:00:00
db:BIDid:109145date:2019-07-10T00:00:00
db:JVNDBid:JVNDB-2019-006813date:2019-07-29T00:00:00
db:CNNVDid:CNNVD-201907-625date:2020-09-30T00:00:00
db:NVDid:CVE-2019-0052date:2020-09-29T00:28:18.473

SOURCES RELEASE DATE
db:VULHUBid:VHN-140083date:2019-07-11T00:00:00
db:BIDid:109145date:2019-07-10T00:00:00
db:JVNDBid:JVNDB-2019-006813date:2019-07-29T00:00:00
db:CNNVDid:CNNVD-201907-625date:2019-07-11T00:00:00
db:NVDid:CVE-2019-0052date:2019-07-11T20:15:11.397