PT-2019-3593 · Juniper Networks · Junos

Published 2019-10-09 · Updated 2020-09-29 · CVE-2019-0071

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Junos OS versions 18.1R3-S4 on EX2300, EX2300-C, and EX3400 Junos OS versions 18.3R1-S3 on EX2300, EX2300-C, and EX3400

Description The Veriexec subsystem in Junos OS, responsible for ensuring only authorized binaries are executed, fails to initialize due to a flaw. This allows a locally authenticated user with shell access to install untrusted executable images and potentially elevate privileges to gain full control of the system. During the installation of an affected version of Junos OS, error messages related to undefined symbols and authentication errors are logged to the console.

Recommendations For Junos OS versions 18.1R3-S4 on EX2300, EX2300-C, and EX3400: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For Junos OS versions 18.3R1-S3 on EX2300, EX2300-C, and EX3400: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-354

CWE-269

CWE-347

Related Identifiers

BDU:2019-03802

CVE-2019-0071

Affected Products

Junos

References · 7

• https://osv.dev/vulnerability/CVE-2019-0071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0071 · Security Note
• https://kb.juniper.net/JSA10978 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03802 · Security Note
• https://juniper.net/documentation/en_US/junos/topics/concept/veriexec.html · Vendor Advisory
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10978&cat=SIRT_1&actp=LIST · Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10978&cat=SIRT_1&actp=LIST · Note