CVE-2019-0040
published 2019-04-10CVE-2019-0040: On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets destined to port 111 should be dropped. Due…
PriorityP354critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
1.92%
77.7th percentile
On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets destined to port 111 should be dropped. Due to an information leak vulnerability, responses were being generated from the source address of the management interface (e.g. fxp0) thus disclosing internal addressing and existence of the management interface itself. A high rate of crafted packets destined to port 111 may also lead to a partial Denial of Service (DoS). Note: Systems with fxp0 disabled or unconfigured are not vulnerable to this issue. This issue only affects Junos OS releases based on FreeBSD 10 or higher (typically Junos OS 15.1+). Administrators can confirm whether systems are running a version of Junos OS based on FreeBSD 10 or higher by typing: user@junos> show version | match kernel JUNOS OS Kernel 64-bit [20181214.223829_fbsd-builder_stable_10] Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X53 versions prior to 15.1X53-D236; 16.1 versions prior to 16.1R7-S1; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8; 17.3 versions prior to 17.3R2; 17.4 versions prior to 17.4R1-S1, 17.4R1-S7, 17.4R2. This issue does not affect Junos OS releases prior to 15.1.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper_networks | junos_os | >= 15.1 < 15.1F6-S12, 15.1R7-S4 | 15.1F6-S12, 15.1R7-S4 |
| juniper_networks | junos_os | >= 15.1X53 < 15.1X53-D236 | 15.1X53-D236 |
| juniper_networks | junos_os | >= 16.1 < 16.1R7-S1 | 16.1R7-S1 |
| juniper_networks | junos_os | >= 16.2 < 16.2R2-S9 | 16.2R2-S9 |
| juniper_networks | junos_os | >= 17.1 < 17.1R3 | 17.1R3 |
| juniper_networks | junos_os | >= 17.2 < 17.2R1-S8 | 17.2R1-S8 |
| juniper_networks | junos_os | >= 17.3 < 17.3R2 | 17.3R2 |
| juniper_networks | junos_os | >= 17.4 < 17.4R1-S1, 17.4R1-S7, 17.4R2 | 17.4R1-S1, 17.4R1-S7, 17.4R2 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Juniper
CVE-2019-0040: On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets destined to port 111 should be drop
vendor_juniper·2019-04-10·CVSS 9.1
CVE-2019-0040 [CRITICAL] CWE-200 CVE-2019-0040: On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets destined to port 111 should be drop
CVE-2019-0040: On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets destined to port 111 should be dropped. Due to an information leak vulnerability, responses were being generated from the source address of the management interface (e.g. fxp0) thus disclosing internal addressing and existence of the management interface itself. A high rate of crafted packets destined to port 111 may also lead to a partial Denial of Service (DoS). Note: Systems with fxp0 disabled or unconfigured are not vulnerable to this issue. This issue only affects Junos OS releases based on FreeBSD 10 or higher (typically Junos OS 15.1+). Administrators can confirm whether systems are running a version of Junos OS based on FreeBSD 10 or higher by typing: us
GHSA
GHSA-99fv-28fj-8fh2: On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI)
ghsa_unreviewed·2022-05-13
CVE-2019-0040 [CRITICAL] CWE-200 GHSA-99fv-28fj-8fh2: On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI)
On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets destined to port 111 should be dropped. Due to an information leak vulnerability, responses were being generated from the source address of the management interface (e.g. fxp0) thus disclosing internal addressing and existence of the management interface itself. A high rate of crafted packets destined to port 111 may also lead to a partial Denial of Service (DoS). Note: Systems with fxp0 disabled or unconfigured are not vulnerable to this issue. This issue only affects Junos OS releases based on FreeBSD 10 or higher (typically Junos OS 15.1+). Administrators can confirm whether systems are running a version of Junos OS based on FreeBSD 10 or higher by typing: user@junos> show
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-0545 .NET Core: NCL - SocketsHttpHandler mishandling 1xx response as a final response leads to info disclosure
bugzilla·2018-12-18·CVSS 7.5
CVE-2019-0545 [HIGH] CVE-2019-0545 .NET Core: NCL - SocketsHttpHandler mishandling 1xx response as a final response leads to info disclosure
CVE-2019-0545 .NET Core: NCL - SocketsHttpHandler mishandling 1xx response as a final response leads to info disclosure
On .NET Core, we mishandle 1xx (includes 100-Continue) response as a final response on SocketsHttpHandler, which will constitute a cross-origin information disclosure vulnerability in case the client multiplexes requests to different origins onto a single persistent connection: the real final response to the first request will be used as a response for a different request on the same connection. (a well behaved server can cause information disclosure as well).
Discussion:
This issue has been addressed in the following products:
.NET Core on Red Hat Enterprise Linux
Via RHSA-2019:0040 https://access.redhat.com/errata/RHSA-2019:0040
---
References:
https://github.co
Bugzilla
CVE-2019-0548 Asp.NET Core: AspNetCoreModule WebSocket DOS
bugzilla·2018-12-18·CVSS 7.5
CVE-2019-0548 [HIGH] CVE-2019-0548 Asp.NET Core: AspNetCoreModule WebSocket DOS
CVE-2019-0548 Asp.NET Core: AspNetCoreModule WebSocket DOS
Today, aborted websocket connections to keep an open connection between ANCM and Kestrel due to a bug with websocket disconnect detection. If continued, internal ports would be exhausted, causing the server to effectively be DDOS’d.
Discussion:
This issue has been addressed in the following products:
.NET Core on Red Hat Enterprise Linux
Via RHSA-2019:0040 https://access.redhat.com/errata/RHSA-2019:0040
---
References:
https://github.com/aspnet/Announcements/issues/335
https://github.com/aspnet/AspNetCore/issues/6488
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0548
Bugzilla
CVE-2019-0564 Asp.NET Core: Kestrel - WebSocket DoS via CancellationToken (CoreFX and ASP.NET)
bugzilla·2018-12-18·CVSS 7.5
CVE-2019-0564 [HIGH] CVE-2019-0564 Asp.NET Core: Kestrel - WebSocket DoS via CancellationToken (CoreFX and ASP.NET)
CVE-2019-0564 Asp.NET Core: Kestrel - WebSocket DoS via CancellationToken (CoreFX and ASP.NET)
The methods for sending and receiving data on a WebSocket accept a CancellationToken, but previously did not implement actual support for cancellation. Activating the cancellation token would result in a no-op, and would not cancel any in progress operations. This provided a potential avenue for DOS, by tying up connections to a server with WebSocket connections that the server could not cancel.
Discussion:
This issue has been addressed in the following products:
.NET Core on Red Hat Enterprise Linux
Via RHSA-2019:0040 https://access.redhat.com/errata/RHSA-2019:0040
---
References:
https://github.com/aspnet/Announcements/issues/334
https://github.com/aspnet/AspNetCore/issues/6487
https://
2019-04-10
Published