Sign-up

ID

VAR-201907-1599


CVE

CVE-2019-0053


TITLE

Juniper Networks Junos OS Buffer error vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2019-006814 // CNNVD: CNNVD-201907-672

DESCRIPTION

Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-based overflow is present in the handling of environment variables when connecting via the telnet client to remote telnet servers. This issue only affects the telnet client — accessible from the CLI or shell — in Junos OS. Inbound telnet services are not affected by this issue. This issue affects: Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D237, 15.1X53-D496, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S11, 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S6, 17.4R2-S3, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R1-S5, 18.2R2-S2, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2. Juniper Networks Junos OS Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Juniper Networks Junos OS is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware equipment. The operating system provides a secure programming interface and Junos SDK. Attackers can exploit this vulnerability to bypass veriexec restrictions. The following products and versions are affected: Juniper Networks Junos OS Release 12.3, Release 12.3X48, Release 14.1X53, Release 15.1, Release 15.1X49, Release 15.1X53, Release 16.1, Release 16.2, Release 17.1, Release 17.2, Release 17.3, Release 17.4 , Version 18.1, Version 18.2, Version 18.2X75, Version 18.3, Version 18.4. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:12.telnet Security Advisory The FreeBSD Project Topic: telnet(1) client multiple vulnerabilities Category: contrib Module: contrib/telnet Announced: 2019-07-24 Credits: Juniper Networks Affects: All supported versions of FreeBSD. Corrected: 2019-07-19 15:37:29 UTC (stable/12, 12.0-STABLE) 2019-07-24 12:51:52 UTC (releng/12.0, 12.0-RELEASE-p8) 2019-07-19 15:27:53 UTC (stable/11, 11.2-STABLE) 2019-07-24 12:51:52 UTC (releng/11.2, 11.2-RELEASE-p12) 2019-07-24 12:51:52 UTC (releng/11.3, 11.3-RELEASE-p1) CVE Name: CVE-2019-0053 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background The telnet(1) command is a TELNET protocol client, used primarily to establish terminal sessions across a network. II. III. Impact These buffer overflows may be triggered when connecting to a malicious server, or by an active attacker in the network path between the client and server. Specially crafted TELNET command sequences may cause the execution of arbitrary code with the privileges of the user invoking telnet(1). IV. Workaround Do not use telnet(1) to connect to untrusted machines or over an untrusted network. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Perform one of the following: 1) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-19:12/telnet.patch # fetch https://security.FreeBSD.org/patches/SA-19:12/telnet.patch.asc # gpg --verify telnet.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>. VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/12/ r350139 releng/12.0/ r350281 stable/11/ r350140 releng/11.2/ r350281 releng/11.3/ r350281 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: <URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN> VII. References <URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0053> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-19:12.telnet.asc> -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl04WltfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n 5cLOzA//YxRZNUr+d8B+t6DnBUbVvthJiY9sQ1YPXUIJmp4QA7wvXr5UjURw+6qv raxEp6JmF06wZK4RjeIFckQD6s2wnjO5VHO80Zbs0nD4NejQGeDAIlVdKqofOtJv bBQNSY3vPAtumyfElc+N19rKetAjGbsUjOMbn87GlWrit4lqcavBQsdmSlQB5gVA dFAFsVxr+ujjATnrCmIpFiaDk0unyJ7Gtz7jiM9I8xZueJtM49/9kNCFFLKCMUl8 HpB2k0cb18GVNJoKtzo1nELOM/oIJVO5HZt1fmYG/RgeL1BSyzg4q/5jXJQopJ2h Qax7fmMP+RpGGrfp9Uom63tj79eQk2NirpUtfAaYkfGKzj6fNcq/7jxZfbobx0R8 uTiF88mlv2/SGxpo11Z/QBqOSYTQtjDRYJvjCo77g7YW8HauECC3tiklpPfFOIO8 m5qNOORKI74Do377GBF3gxDF2T8ILwj1j7nKHf3apotvQXJkkbpWBG7ADRTFcZWd PMKdYiDPHV33YmCAg9tOAqV4O7TvaB07ZLKiI6kuSBtPVrazB8Az/oRJwfF6JQ6g 4ZdinyCrXWYrWslkW8402GKCERFFYJUvwLSUqHxYMRgZWPy9zf/mH56vh4bleYnP kz2X7OgtB3Juu0Uzwv927+KZuyzitniaPlLe9tsyBwXFbUM+BrY= =LWVf -----END PGP SIGNATURE-----

Trust: 2.43

sources: NVD: CVE-2019-0053 // JVNDB: JVNDB-2019-006814 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-140084 // VULMON: CVE-2019-0053 // PACKETSTORM: 153746

AFFECTED PRODUCTS

vendor:junipermodel:junosscope:eqversion:15.1x53

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.2

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:12.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:14.1x53

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.4

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:15.1x49

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.2

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:16.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:16.2

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.2x75

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.4

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:12.3r12

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:12.3x48

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:15.1

Trust: 1.0

vendor:junipermodel:junos osscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2019-006814 // NVD: CVE-2019-0053

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-0053
value: HIGH

Trust: 1.0

sirt@juniper.net: CVE-2019-0053
value: HIGH

Trust: 1.0

NVD: CVE-2019-0053
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201907-672
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

VULHUB: VHN-140084
value: MEDIUM

Trust: 0.1

VULMON: CVE-2019-0053
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-0053
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-140084
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sirt@juniper.net: CVE-2019-0053
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2019-0053
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-140084 // VULMON: CVE-2019-0053 // JVNDB: JVNDB-2019-006814 // CNNVD: CNNVD-201907-672 // CNNVD: CNNVD-202104-975 // NVD: CVE-2019-0053 // NVD: CVE-2019-0053

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.1

problemtype:CWE-121

Trust: 1.0

problemtype:CWE-119

Trust: 0.9

sources: VULHUB: VHN-140084 // JVNDB: JVNDB-2019-006814 // NVD: CVE-2019-0053

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201907-672

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201907-672

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-006814

PATCH
title:JSA10947url:https://kb.juniper.net/JSA10947
Trust: 0.8
title:Juniper Networks Junos OS Security hole 	 Repair measuresurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=95208
Trust: 0.6
title:Debian CVElist Bug Report Logs: inetutils: CVE-2019-0053url:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=1c1b62240ae75f2c92c22ba11fb42d13
Trust: 0.1
title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2019-0053
Trust: 0.1
title:Arch Linux Advisories: [ASA-202106-20] inetutils: arbitrary code executionurl:https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-202106-20
Trust: 0.1
title:inetutils-CVE-2019-0053-Patched-PKGBUILDurl:https://github.com/dreamsmasher/inetutils-CVE-2019-0053-Patched-PKGBUILD 
Trust: 0.1
title:pacheckurl:https://github.com/FritzJo/pacheck 
Trust: 0.1
title:PoCurl:https://github.com/Jonathan-Elias/PoC 
Trust: 0.1
title:CVE-POCurl:https://github.com/0xT11/CVE-POC 
Trust: 0.1
title:PoC-in-GitHuburl:https://github.com/developer3000S/PoC-in-GitHub 
Trust: 0.1
title:PoC-in-GitHuburl:https://github.com/nomi-sec/PoC-in-GitHub 
Trust: 0.1
title:PoC-in-GitHuburl:https://github.com/hectorgie/PoC-in-GitHub 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2019-0053 // 
            
            
            
            JVNDB: JVNDB-2019-006814 // 
            
            
            
            CNNVD: CNNVD-201907-672

EXTERNAL IDS
db:NVDid:CVE-2019-0053
Trust: 2.7
db:PACKETSTORMid:153746
Trust: 1.9
db:JUNIPERid:JSA10947
Trust: 1.8
db:EXPLOIT-DBid:45982
Trust: 1.8
db:JVNDBid:JVNDB-2019-006814
Trust: 0.8
db:CNNVDid:CNNVD-201907-672
Trust: 0.7
db:AUSCERTid:ESB-2019.2792
Trust: 0.6
db:AUSCERTid:ESB-2019.2563
Trust: 0.6
db:AUSCERTid:ESB-2022.6150
Trust: 0.6
db:JUNIPERid:JSA10943
Trust: 0.6
db:JUNIPERid:JSA10949
Trust: 0.6
db:CS-HELPid:SB2021060915
Trust: 0.6
db:CS-HELPid:SB2021041363
Trust: 0.6
db:CNNVDid:CNNVD-202104-975
Trust: 0.6
db:VULHUBid:VHN-140084
Trust: 0.1
db:VULMONid:CVE-2019-0053
Trust: 0.1
sources:
            
            
            VULHUB: VHN-140084 // 
            
            
            
            VULMON: CVE-2019-0053 // 
            
            
            
            JVNDB: JVNDB-2019-006814 // 
            
            
            
            PACKETSTORM: 153746 // 
            
            
            
            CNNVD: CNNVD-201907-672 // 
            
            
            
            CNNVD: CNNVD-202104-975 // 
            
            
            
            NVD: CVE-2019-0053

REFERENCES
url:https://security.freebsd.org/advisories/freebsd-sa-19:12.telnet.asc
Trust: 2.4
url:http://packetstormsecurity.com/files/153746/freebsd-security-advisory-freebsd-sa-19-12.telnet.html
Trust: 2.4
url:https://seclists.org/bugtraq/2019/jul/45
Trust: 1.8
url:https://kb.juniper.net/jsa10947
Trust: 1.8
url:https://www.exploit-db.com/exploits/45982
Trust: 1.8
url:https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-0053
Trust: 1.5
url:https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html
Trust: 1.0
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0053
Trust: 0.8
url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10949
Trust: 0.6
url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10947
Trust: 0.6
url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10943
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2021060915
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.6150
Trust: 0.6
url:https://vigilance.fr/vulnerability/junos-os-buffer-overflow-via-telnet-client-29745
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.2563/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.2792/
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2021041363
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/787.html
Trust: 0.1
url:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=945861
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://github.com/dreamsmasher/inetutils-cve-2019-0053-patched-pkgbuild
Trust: 0.1
url:https://security.archlinux.org/cve-2019-0053
Trust: 0.1
url:https://www.freebsd.org/handbook/makeworld.html>.
Trust: 0.1
url:https://security.freebsd.org/>.
Trust: 0.1
url:https://security.freebsd.org/patches/sa-19:12/telnet.patch.asc
Trust: 0.1
url:https://security.freebsd.org/patches/sa-19:12/telnet.patch
Trust: 0.1
url:https://svnweb.freebsd.org/base?view=revision&revision=nnnnnn>
Trust: 0.1
url:https://security.freebsd.org/advisories/freebsd-sa-19:12.telnet.asc>
Trust: 0.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0053>
Trust: 0.1
sources:
            
            
            VULHUB: VHN-140084 // 
            
            
            
            VULMON: CVE-2019-0053 // 
            
            
            
            JVNDB: JVNDB-2019-006814 // 
            
            
            
            PACKETSTORM: 153746 // 
            
            
            
            CNNVD: CNNVD-201907-672 // 
            
            
            
            CNNVD: CNNVD-202104-975 // 
            
            
            
            NVD: CVE-2019-0053

CREDITS
Juniper Networks
Trust: 0.1
sources:
            
            
            PACKETSTORM: 153746

SOURCES
db:VULHUBid:VHN-140084
db:VULMONid:CVE-2019-0053
db:JVNDBid:JVNDB-2019-006814
db:PACKETSTORMid:153746
db:CNNVDid:CNNVD-201907-672
db:CNNVDid:CNNVD-202104-975
db:NVDid:CVE-2019-0053

LAST UPDATE DATE
2024-11-23T19:51:19.586000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-140084date:2020-09-29T00:00:00
db:VULMONid:CVE-2019-0053date:2020-09-29T00:00:00
db:JVNDBid:JVNDB-2019-006814date:2019-07-29T00:00:00
db:CNNVDid:CNNVD-201907-672date:2022-11-28T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:NVDid:CVE-2019-0053date:2024-11-21T04:16:08.593

SOURCES RELEASE DATE
db:VULHUBid:VHN-140084date:2019-07-11T00:00:00
db:VULMONid:CVE-2019-0053date:2019-07-11T00:00:00
db:JVNDBid:JVNDB-2019-006814date:2019-07-29T00:00:00
db:PACKETSTORMid:153746date:2019-07-24T14:02:22
db:CNNVDid:CNNVD-201907-672date:2019-07-11T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:NVDid:CVE-2019-0053date:2019-07-11T20:15:11.960