CVE-2019-0014 - Junos OS: QFX and PTX Series: FPC process crashes after J-Flow processes a malformed packet

Back Back to CVE browser

HIGH

Junos OS: QFX and PTX Series: FPC process crashes after J-Flow processes a malformed packet

Published Jan 15, 2019

7.5

HIGH

CVSS 3.0

EPSS 1.71%

Description

On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC (Flexible PIC Concentrator) process which causes all interfaces to go down. By continuously sending the offending packet, an attacker can repeatedly crash the FPC process causing a sustained Denial of Service (DoS). This issue affects both IPv4 and IPv6 packet processing. Affected releases are Juniper Networks Junos OS on QFX and PTX Series: 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1; 18.2 versions prior to 18.2R1-S3, 18.2R2; 17.2X75 versions prior to 17.2X75-D91, 17.2X75-D100.

Affected products

Vendor Juniper Networks Product Junos OS Default
n/a
- Version
  17.2X75
  Status
  affected
  Constraints
  <17.2X75-D91, 17.2X75-D100
- Version
  17.4
  Status
  affected
  Constraints
  <17.4R2-S1, 17.4R3
- Version
  18.1
  Status
  affected
  Constraints
  <18.1R3-S1, 18.1R4
- Version
  18.2
  Status
  affected
  Constraints
  <18.2R1-S3, 18.2R2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Juniper Networks

Junos OS

n/a

Version	Status	Constraints
17.2X75	affected	<17.2X75-D91, 17.2X75-D100
17.4	affected	<17.4R2-S1, 17.4R3
18.1	affected	<18.1R3-S1, 18.1R4
18.2	affected	<18.2R1-S3, 18.2R2

Remediation

Vendor solution

The following software releases have been updated to resolve this specific issue: Junos OS 17.2X75-D91, 17.2X75-D100, 17.4R2-S1, 17.4R3, 18.1R3-S1, 18.2R1-S3, 18.2R2, 18.2X75-D5, 18.3R1, and all subsequent releases.

Weaknesses (1)

CWE-19

References (3)

http://www.securityfocus.com/bid/106556
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0821
Advisory
https://kb.juniper.net/JSA10914
x_refsource_CONFIRMMitigationPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/106556		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0821		Advisory
https://kb.juniper.net/JSA10914		x_refsource_CONFIRMMitigationPatchVendor Advisory