CVE-2019-0041
published 2019-04-10CVE-2019-0041: On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail…
PriorityP345high8.6CVSS 3.1
AVNACLPRNUINSCCNINAH
EPSS
0.87%
54.8th percentile
On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | ex_series | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper_networks | junos_os | >= 18.2 < 18.2R1-S2, 18.2R2 | 18.2R1-S2, 18.2R2 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
cisa7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability
cisa·2021-11-03·CVSS 7.8
CVE-2020-0069 [HIGH] CWE-787 Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability
Vulnerability: Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability
Affected: MediaTek Multiple Chipsets
Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu."
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-0069
Remediation Due Date: 2022-05-03
CISA
Android Kernel Out-of-Bounds Write Vulnerability
cisa·2021-11-03·CVSS 7.8
CVE-2020-0041 [HIGH] CWE-20 Android Kernel Out-of-Bounds Write Vulnerability
Vulnerability: Android Kernel Out-of-Bounds Write Vulnerability
Affected: Android Android Kernel
Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu."
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-0041
Remediation Due Date: 2022-05-03
CISA
Android Kernel Use-After-Free Vulnerability
cisa·2021-11-03·CVSS 7.8
CVE-2019-2215 [HIGH] CWE-416 Android Kernel Use-After-Free Vulnerability
Vulnerability: Android Kernel Use-After-Free Vulnerability
Affected: Android Android Kernel
Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain "AbstractEmu."
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-2215
Remediation Due Date: 2022-05-03
Juniper
CVE-2019-0041: On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device
vendor_juniper·2019-04-10·CVSS 8.6
CVE-2019-0041 [HIGH] CWE-284 CVE-2019-0041: On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device
CVE-2019-0041: On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices.
GHSA
GHSA-5jhv-p44r-72j3: On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0)
ghsa_unreviewed·2022-05-13
CVE-2019-0041 [HIGH] GHSA-5jhv-p44r-72j3: On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0)
On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-04-10
Published