Design/Logic Flaw

Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using the jdhcpd daemon configured to respond to IPv6 requests. Once started, memory consumption will eventually impact any IPv4 or IPv6 request serviced by the...

Design/Logic Flaw

In a Dynamic Host Configuration Protocol version 6 DHCPv6 environment, the jdhcpd daemon may crash and restart upon receipt of certain DHCPv6 solicit messages received from a DHCPv6 client. By continuously sending the same crafted packet, an attacker can repeatedly crash the jdhcpd process causin...

CVE-2019-0033

A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of Service DoS. This issue affects only IPv4. Affected releases are Juniper Networks Junos OS: 12.1X46 versions above and including 12.1X46-D2...

CVE-2019-0040

On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance IRI. External packets destined to port 111 should be dropped. Due to an information leak vulnerability, responses were being generated from the source address of the management interface e.g. fxp0 thus...

CVE-2019-0036

When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" e.g. "internal-1", "internal-2", etc. are silently ignored. No warning is issued during configuration, and the config is committed without error, but the filter criteria will match all packets...

CVE-2019-0040 Junos OS: Specially crafted packets sent to port 111 on any interface triggers responses from the management interface

On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance IRI. External packets destined to port 111 should be dropped. Due to an information leak vulnerability, responses were being generated from the source address of the management interface e.g. fxp0 thus...

CVE-2019-0035

CVE-2019-0035 describes an administrative bypass on Juniper Networks Junos OS. When the insecure console port setting is enabled, an attacker with physical access can change the root password on systems booted from an OAM volume using the command set system root-authentication plain-text-password...

CVE-2019-0039

CVE-2019-0039 affects Junos OS where REST API is enabled, enabling brute-force login attempts due to a high default connection limit. Publicly documented details list affected Junos OS versions (e.g., 14.1X53 before 14.1X53-D49; 15.1 family before various 15.x builds; up to 18.3R1-S1), with remed...

CVE-2019-0040

CVE-2019-0040 affects Juniper Junos OS on multiple 15.x–17.x releases based on FreeBSD 10 or higher. The issue is an information disclosure in rpcbind: external packets to port 111 may elicit responses from the management interface (e.g., fxp0), exposing internal addressing and the existence of t...

CVE-2019-0036

CVE-2019-0036 affects Juniper Networks Junos OS and causes stateless firewall filter terms named like internal-n (for example internal-1) to be silently ignored during configuration. The config commits without error, but the filter criteria can inadvertently match all packets, leading to unintend...

CVE-2019-0041

CVE-2019-0041 affects Juniper Networks Junos OS on the EX4300-MP Series. With any lo0 filters applied, transit network traffic could reach the control plane via the loopback interface (lo0) and the device may fail to forward such traffic. Affected software: Junos OS 18.2 prior to 18.2R1-S2 and 18...

CVE-2019-0039 Junos OS: Login credentials are vulnerable to brute force attacks through the REST API

If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password...

CVE-2019-0043 Junos OS: RPD process crashes upon receipt of a specific SNMP packet

In MPLS environments, receipt of a specific SNMP packet may cause the routing protocol daemon RPD process to crash and restart. By continuously sending a specially crafted SNMP packet, an attacker can repetitively crash the RPD process causing prolonged denial of service. No other Juniper Network...

CVE-2019-0019 BGP packets can trigger rpd crash when BGP tracing is enabled.

When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon rpd process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to...

CVE-2019-0032 Junos Space Service Now and Service Insight: Organization username and password stored in plaintext in log files.

A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper...

CVE-2019-0044 Junos OS: SRX5000 series: Kernel crash (vmcore) upon receipt of a specific packet on fxp0 interface

Receipt of a specific packet on the out-of-band management interface fxp0 may cause the system to crash and restart vmcore. By continuously sending a specially crafted packet to the fxp0 interface, an attacker can repetitively crash the rpd process causing prolonged Denial of Service DoS. Affecte...

CVE-2019-0038

The CVE-2019-0038 entry concerns Juniper SRX340/SRX345 devices running Junos OS. Affected component: management interface (fxp0). Root cause: crafted packets destined to fxp0 can exhaust buffer space, causing a denial of service (DoS) and service unresponsiveness. Impact is DoS affecting only SRX...

CVE-2019-0043

CVE-2019-0043 describes a denial-of-service vulnerability in Junos OS where receipt of a specially crafted SNMP packet can cause the RPD process to crash and restart, leading to prolonged DoS. Affected Juniper releases span multiple lines of Junos OS across SRX, EX/QFX, NFX, ACX, and other series...

CVE-2019-0035 Junos OS: 'set system ports console insecure' allows root password recovery on OAM volumes

When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set system root-authentication plain-text-password" on systems booted from an OAM Operations, Administration, and Maintenance volume, leading to...

CVE-2019-0031 Junos OS: jdhcpd daemon memory consumption Denial of Service when receiving specific IPv6 DHCP packets.

Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using the jdhcpd daemon configured to respond to IPv6 requests. Once started, memory consumption will eventually impact any IPv4 or IPv6 request serviced by the...