Lucene search

JuniperCVE-2019-0073

HistoryOct 09, 2019 - 8:15 p.m.

CVE-2019-0073

2019-10-0920:15:18

CWE-732

CWE-281

juniper

web.nvd.nist.gov

cve-2019-0073

juniper networks

junos os

pki keys

insecure file permissions

access vulnerability

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

Percentile

12.6%

JSON

The PKI keys exported using the command “run request security pki key-pair export” on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D180; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2.

Affected configurations

Nvd

Node

juniperjunosMatch15.1x49-

juniperjunosMatch15.1x49d10

juniperjunosMatch15.1x49d100

juniperjunosMatch15.1x49d110

juniperjunosMatch15.1x49d120

juniperjunosMatch15.1x49d130

juniperjunosMatch15.1x49d140

juniperjunosMatch15.1x49d150

juniperjunosMatch15.1x49d160

juniperjunosMatch15.1x49d170

juniperjunosMatch15.1x49d20

juniperjunosMatch15.1x49d30

juniperjunosMatch15.1x49d35

juniperjunosMatch15.1x49d40

juniperjunosMatch15.1x49d45

juniperjunosMatch15.1x49d50

juniperjunosMatch15.1x49d55

juniperjunosMatch15.1x49d60

juniperjunosMatch15.1x49d65

juniperjunosMatch15.1x49d70

juniperjunosMatch15.1x49d75

juniperjunosMatch15.1x49d80

juniperjunosMatch15.1x49d90

Node

juniperjunosMatch17.3-

juniperjunosMatch17.3r1

juniperjunosMatch17.3r2

juniperjunosMatch17.3r2-s1

juniperjunosMatch17.3r2-s2

juniperjunosMatch17.3r3

juniperjunosMatch17.3r3-s1

juniperjunosMatch17.3r3-s2

juniperjunosMatch17.3r3-s3

juniperjunosMatch17.3r3-s4

juniperjunosMatch17.3r3-s5

juniperjunosMatch17.3r3-s6

Node

juniperjunosMatch17.4-

juniperjunosMatch17.4r1

juniperjunosMatch17.4r1-s1

juniperjunosMatch17.4r1-s2

juniperjunosMatch17.4r1-s4

juniperjunosMatch17.4r1-s6

juniperjunosMatch17.4r1-s7

juniperjunosMatch17.4r2

juniperjunosMatch17.4r2-s1

juniperjunosMatch17.4r2-s3

juniperjunosMatch17.4r2-s4

juniperjunosMatch17.4r2-s5

juniperjunosMatch17.4r2-s6

juniperjunosMatch17.4r2-s7

Node

juniperjunosMatch18.1-

juniperjunosMatch18.1r2

juniperjunosMatch18.1r2-s1

juniperjunosMatch18.1r2-s2

juniperjunosMatch18.1r2-s4

juniperjunosMatch18.1r3

juniperjunosMatch18.1r3-s2

juniperjunosMatch18.1r3-s3

juniperjunosMatch18.1r3-s4

juniperjunosMatch18.1r3-s5

juniperjunosMatch18.1r3-s6

juniperjunosMatch18.1r3-s7

Node

juniperjunosMatch18.2-

juniperjunosMatch18.2r1-s5

juniperjunosMatch18.2r2

juniperjunosMatch18.2r2-s1

juniperjunosMatch18.2r2-s2

juniperjunosMatch18.2r2-s3

juniperjunosMatch18.2r2-s4

Node

juniperjunosMatch18.3-

juniperjunosMatch18.3r1

juniperjunosMatch18.3r1-s1

juniperjunosMatch18.3r1-s2

juniperjunosMatch18.3r1-s3

Node

juniperjunosMatch18.4-

juniperjunosMatch18.4r1

juniperjunosMatch18.4r1-s2

VendorProductVersionCPE
juniperjunos15.1x49cpe:2.3:o:juniper:junos:15.1x49:-:*:*:*:*:*:*
juniperjunos15.1x49cpe:2.3:o:juniper:junos:15.1x49:d10:*:*:*:*:*:*
juniperjunos15.1x49cpe:2.3:o:juniper:junos:15.1x49:d100:*:*:*:*:*:*
juniperjunos15.1x49cpe:2.3:o:juniper:junos:15.1x49:d110:*:*:*:*:*:*
juniperjunos15.1x49cpe:2.3:o:juniper:junos:15.1x49:d120:*:*:*:*:*:*
juniperjunos15.1x49cpe:2.3:o:juniper:junos:15.1x49:d130:*:*:*:*:*:*
juniperjunos15.1x49cpe:2.3:o:juniper:junos:15.1x49:d140:*:*:*:*:*:*
juniperjunos15.1x49cpe:2.3:o:juniper:junos:15.1x49:d150:*:*:*:*:*:*
juniperjunos15.1x49cpe:2.3:o:juniper:junos:15.1x49:d160:*:*:*:*:*:*
juniperjunos15.1x49cpe:2.3:o:juniper:junos:15.1x49:d170:*:*:*:*:*:*

Vendor	Product	Version	CPE
juniper	junos	15.1x49	cpe:2.3:o:juniper:junos:15.1x49:-::::::
juniper	junos	15.1x49	cpe:2.3:o:juniper:junos:15.1x49:d10::::::
juniper	junos	15.1x49	cpe:2.3:o:juniper:junos:15.1x49:d100::::::
juniper	junos	15.1x49	cpe:2.3:o:juniper:junos:15.1x49:d110::::::
juniper	junos	15.1x49	cpe:2.3:o:juniper:junos:15.1x49:d120::::::
juniper	junos	15.1x49	cpe:2.3:o:juniper:junos:15.1x49:d130::::::
juniper	junos	15.1x49	cpe:2.3:o:juniper:junos:15.1x49:d140::::::
juniper	junos	15.1x49	cpe:2.3:o:juniper:junos:15.1x49:d150::::::
juniper	junos	15.1x49	cpe:2.3:o:juniper:junos:15.1x49:d160::::::
juniper	junos	15.1x49	cpe:2.3:o:juniper:junos:15.1x49:d170::::::

Rows per page:

1-10 of 761

CNA Affected

[
  {
    "product": "Junos OS",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "15.1X49-D180",
        "status": "affected",
        "version": "15.1X49",
        "versionType": "custom"
      },
      {
        "lessThan": "17.3R3-S7",
        "status": "affected",
        "version": "17.3",
        "versionType": "custom"
      },
      {
        "lessThan": "17.4R2-S8, 17.4R3",
        "status": "affected",
        "version": "17.4",
        "versionType": "custom"
      },
      {
        "lessThan": "18.1R3-S8",
        "status": "affected",
        "version": "18.1",
        "versionType": "custom"
      },
      {
        "lessThan": "18.2R3",
        "status": "affected",
        "version": "18.2",
        "versionType": "custom"
      },
      {
        "lessThan": "18.3R2",
        "status": "affected",
        "version": "18.3",
        "versionType": "custom"
      },
      {
        "lessThan": "18.4R2",
        "status": "affected",
        "version": "18.4",
        "versionType": "custom"
      }
    ]
  }
]

References

kb.juniper.net/JSA10974

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2019-0073