CVE-2019-0041 — Improper Access Control in Networks Junos OS

CWE-284 — Improper Access ControlCWE-787 — Out-of-bounds WriteCWE-20 — Improper Input ValidationCWE-416 — Use After Free6 documents4 sources
Severity
8.6HIGHNVD
CISA7.8
EPSS
0.3%
top 48.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Juniper Networks Junos OSJuniper JunosJuniper EX Series+1 more
Timeline
PublishedApr 10
Latest updateMay 13

Description

On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages4 packages

▶CVEListV5juniper_networks/junos_os18.2 — 18.2R1-S2, 18.2R2
▶NVDjuniper/junos18.2

🔴Vulnerability Details

1
GHSA
GHSA-5jhv-p44r-72j3: On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0)↗2022-05-13
▶

📋Vendor Advisories

4
CISA
Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability↗2021-11-03
▶
CISA
Android Kernel Out-of-Bounds Write Vulnerability↗2021-11-03
▶
CISA
Android Kernel Use-After-Free Vulnerability↗2021-11-03
▶
Juniper
CVE-2019-0041: On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device↗2019-04-10
▶
CVE-2019-0041 — Improper Access Control | cvebase