PT-2019-3484 · Juniper Networks · Junos

Published 2019-10-09 · Updated 2021-02-05 · CVE-2019-0060

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 15.1X49-D171 Junos OS versions 15.1X49-D180 on SRX Series Junos OS versions 18.2R2-S1 and later, prior to 18.2R3 on SRX Series Junos OS versions prior to 18.4R2 on SRX Series

Description The issue is related to errors in processing IP packets through an IPsec tunnel, which may cause the flowd process to crash and restart, resulting in an extended Denial of Service (DoS) condition. This issue only occurs when IPSec tunnels are configured. Systems without IPSec tunnel configurations are not affected.

Recommendations For versions prior to 15.1X49-D171, update to 15.1X49-D171 or later. For version 15.1X49-D180 on SRX Series, update to a version that includes the fix. For versions 18.2R2-S1 and later, prior to 18.2R3 on SRX Series, update to 18.2R3 or later. For versions prior to 18.4R2 on SRX Series, update to 18.4R2 or later. As a temporary workaround, consider disabling IPsec tunnels until a patch is available.

Fix

DoS

Improper Handling of Exceptional Conditions

RCE

Weakness Enumeration

CWE-755

CWE-20

Related Identifiers

BDU:2019-03659

CVE-2019-0060

Affected Products

Junos

References · 7

• https://bdu.fstec.ru/vul/2019-03659 · Security Note
• https://juniper.net/documentation/en_US/junos/topics/topic-map/ipsec-tunnel-traffic-configuration.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0060 · Security Note
• https://kb.juniper.net/JSA10959 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0060 · Vendor Advisory
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10959&cat=SIRT_1&actp=LIST · Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10959&cat=SIRT_1&actp=LIST · Note