Vulnerabilities > CVE-2019-0063 - Unspecified vulnerability in Juniper Junos

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

juniper

nessus

NVD

Published: 2019-10-09

Updated: 2021-07-21

Summary

When an MX Series Broadband Remote Access Server (BRAS) is configured as a Broadband Network Gateway (BNG) with DHCPv6 enabled, jdhcpd might crash when receiving a specific crafted DHCP response message on a subscriber interface. The daemon automatically restarts without intervention, but continuous receipt of specific crafted DHCP messages will repeatedly crash jdhcpd, leading to an extended Denial of Service (DoS) condition. This issue only affects systems configured with DHCPv6 enabled. DHCPv4 is unaffected by this issue. This issue affects Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S5 on MX Series; 16.1 versions prior to 16.1R7-S5 on MX Series; 16.2 versions prior to 16.2R2-S10 on MX Series; 17.1 versions prior to 17.1R3-S1 on MX Series; 17.2 versions prior to 17.2R3-S2 on MX Series; 17.3 versions prior to 17.3R3-S6 on MX Series; 17.4 versions prior to 17.4R2-S5, 17.4R3 on MX Series; 18.1 versions prior to 18.1R3-S6 on MX Series; 18.2 versions prior to 18.2R2-S4, 18.2R3 on MX Series; 18.2X75 versions prior to 18.2X75-D50 on MX Series; 18.3 versions prior to 18.3R1-S5, 18.3R3 on MX Series; 18.4 versions prior to 18.4R2 on MX Series; 19.1 versions prior to 19.1R1-S2, 19.1R2 on MX Series.

Vulnerable Configurations

Part	Description	Count
OS	Juniper Juniper Junos 15.1 Juniper Junos 16.1 Juniper Junos 16.2 Juniper Junos 17.1 Juniper Junos 17.2 Juniper Junos 17.3 Juniper Junos 17.4 Juniper Junos 18.1 Juniper Junos 18.2 Juniper Junos 18.2X75 Juniper Junos 18.3 Juniper Junos 18.4 Juniper Junos 19.1	119
Hardware	Juniper Juniper Mx10 - Juniper Mx10003 - Juniper Mx10008 - Juniper Mx10016 - Juniper Mx104 - Juniper Mx150 - Juniper Mx2008 - Juniper Mx2010 - Juniper Mx2020 - Juniper Mx204 - Juniper Mx240 - Juniper Mx40 - Juniper Mx480 - Juniper MX5 - Juniper Mx80 - Juniper Mx960 - Juniper VMX -	17

Nessus

NASL family	Junos Local Security Checks
NASL id	JUNIPER_JSA10970.NASL
description	The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10970 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	133303
published	2020-01-29
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133303
title	Juniper JSA10970
code	# # (C) Tenable Network Security, Inc. # include('compat.inc'); if (description) { script_id(133303); script_version("1.1"); script_cvs_date("Date: 2020/01/29"); script_cve_id( "CVE-2019-0047", "CVE-2019-0050", "CVE-2019-0054", "CVE-2019-0055", "CVE-2019-0057", "CVE-2019-0058", "CVE-2019-0059", "CVE-2019-0060", "CVE-2019-0062", "CVE-2019-0063", "CVE-2019-0064", "CVE-2019-0066", "CVE-2019-0067", "CVE-2019-0068", "CVE-2019-0073", "CVE-2019-0075" ); script_xref(name:"IAVA", value:"2019-A-0388"); script_name(english:"Juniper JSA10970"); script_summary(english:"Checks the Junos version and build date."); script_set_attribute(attribute:"synopsis", value: "The remote device is missing a vendor-supplied security patch."); script_set_attribute(attribute:"description", value: "The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10970 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number."); script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/KB16613"); script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/KB16765"); script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/KB16446"); script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/JSA10970"); script_set_attribute(attribute:"solution", value: "Apply the relevant Junos software release referenced in Juniper advisory JSA10970"); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-0047"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/28"); script_set_attribute(attribute:"patch_publication_date", value:"2020/01/28"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/01/29"); script_set_attribute(attribute:"plugin_type", value:"combined"); script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos"); script_set_attribute(attribute:"stig_severity", value:"I"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Junos Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("junos_version.nasl"); script_require_keys("Host/Juniper/JUNOS/Version", "Host/Juniper/model"); exit(0); } include('audit.inc'); include('junos.inc'); include('misc_func.inc'); ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version'); model = get_kb_item_or_exit('Host/Juniper/model'); fixes = make_array(); fixes['12.1X46'] = '12.1X46-D86'; fixes['12.3'] = '12.3R12-S13'; fixes['12.3X48'] = '12.3X48-D80'; fixes['14.1X53'] = '14.1X53-D51'; if (ver =~ "^15\.1F") fixes['15.1F'] = '15.1F6-S13'; else fixes['15.1'] = '15.1R7-S4'; fixes['15.1X49'] = '15.1X49-D171'; fixes['15.1X53'] = '15.1X53-D69'; fixes['16.1'] = '16.1R7-S5'; fixes['16.2'] = '16.2R2-S9'; fixes['17.1'] = '17.1R3'; if (ver =~ "^17\.2R1") fixes['17.2'] = '17.2R1-S8'; else if (ver =~ "^17\.2R2") fixes['17.2'] = '17.2R2-S7'; else if (ver =~ "^17\.2R3") fixes['17.2'] = '17.2R3-S1'; fixes['17.3'] = '17.3R3-S6'; if (ver =~ "^17\.4R1") fixes['17.4'] = '17.4R1-S7'; else if (ver =~ "^17\.4R2") fixes['17.4'] = '17.4R2-S4'; else fixes['17.4'] = '17.4R3'; fixes['18.1'] = '18.1R3-S5'; if (ver =~ "^18\.2R1") fixes['18.2'] = '18.2R1-S5'; else if (ver =~ "^18\.2R2") fixes['18.2'] = '18.2R2-S3'; else fixes['18.2'] = '18.2R3'; if (ver =~ "^18\.3R1") fixes['18.3'] = '18.3R1-S3'; else if (ver =~ "^18\.3R2") fixes['18.3'] = '18.3R2'; else if (ver =~ "^18\.3R3") fixes['18.3'] = '18.3R3'; if (ver =~ "^18\.4R1") fixes['18.4'] = '18.4R1-S2'; else fixes['18.4'] = '18.4R2'; fix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE); report = get_report(ver:ver, fix:fix); security_report_v4(severity:SECURITY_WARNING, port:0, extra:report);

NASL family	Junos Local Security Checks
NASL id	JUNIPER_JSA10962.NASL
description	The version of Junos OS installed on the remote host is prior to 15.1R7-S5, 16.1R7-S5, 16.2R2-S10, 17.1R3-S1, 17.2R3-S2, 17.3R3-S6, 17.4R2-S5, 18.1R3-S6, 18.2R2-S4, 18.2X75-D50, 18.3R1-S5, 18.4R2, or 19.1R1-S2. It is, therefore, affected by a vulnerability as referenced in the JSA10962 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	130053
published	2019-10-18
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/130053
title	Juniper JSA10962
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(130053); script_version("1.1"); script_cvs_date("Date: 2019/10/18 11:42:09"); script_cve_id("CVE-2019-0063"); script_xref(name:"JSA", value:"JSA10962"); script_xref(name:"IAVA", value:"2019-A-0388"); script_name(english:"Juniper JSA10962"); script_set_attribute(attribute:"synopsis", value: "The remote device is missing a vendor-supplied security patch."); script_set_attribute(attribute:"description", value: "The version of Junos OS installed on the remote host is prior to 15.1R7-S5, 16.1R7-S5, 16.2R2-S10, 17.1R3-S1, 17.2R3-S2, 17.3R3-S6, 17.4R2-S5, 18.1R3-S6, 18.2R2-S4, 18.2X75-D50, 18.3R1-S5, 18.4R2, or 19.1R1-S2. It is, therefore, affected by a vulnerability as referenced in the JSA10962 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/JSA10962"); script_set_attribute(attribute:"solution", value: "Apply the relevant Junos software release referenced in Juniper advisory JSA10962"); script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-8748"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/09"); script_set_attribute(attribute:"patch_publication_date", value:"2019/10/09"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/18"); script_set_attribute(attribute:"plugin_type", value:"combined"); script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos"); script_set_attribute(attribute:"stig_severity", value:"I"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Junos Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("junos_version.nasl"); script_require_keys("Host/Juniper/JUNOS/Version", "Host/Juniper/model"); exit(0); } include("audit.inc"); include("junos.inc"); include("misc_func.inc"); ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version'); model = get_kb_item_or_exit('Host/Juniper/model'); fixes = make_array(); if (model =~ "^MX") { fixes["15.1"] = "15.1R7-S5"; fixes["16.1"] = "16.1R7-S5"; fixes["16.2"] = "16.2R2-S10"; fixes["17.1"] = "17.1R3-S1"; fixes["17.2"] = "17.2R3-S2"; fixes["17.3"] = "17.3R3-S6"; fixes["17.4"] = "17.4R2-S5"; fixes["18.1"] = "18.1R3-S6"; fixes["18.2"] = "18.2R2-S4"; fixes["18.2X75"] = "18.2X75-D50"; fixes["18.3"] = "18.3R1-S5"; fixes["18.4"] = "18.4R2"; fixes["19.1"] = "19.1R1-S2"; } fix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE); report = get_report(ver:ver, fix:fix); security_report_v4(severity:SECURITY_WARNING, port:0, extra:report);

References

https://kb.juniper.net/JSA10962