CVE-2019-0006

Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configuration

State: Published
Severity: 9.8 Critical
Published: Jan 15, 2019
Updated: Sep 16, 2024
Reserved: Oct 11, 2018

Read the record on cve.org

Description

A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, QFX and MX Series devices in a Virtual Chassis configuration. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. This issue only occurs when the crafted packet it destined to the device. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47 on EX and QFX Virtual Chassis Platforms; 15.1 versions prior to 15.1R7-S3 all Virtual Chassis Platforms 15.1X53 versions prior to 15.1X53-D50 on EX and QFX Virtual Chassis Platforms.

Scores

CVSS	Score	Vector	Source
3.0	9.8 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	juniper

Weaknesses

CWE-908 Use of Uninitialized Resource

Affected Products

Product	Versions
Junos OSJuniper Networks	14.1X53 to before 14.1X53-D47Affected 15.1X53 to before 15.1X53-D50Affected
Junos OSJuniper Networks	15.1 to before 15.1R7-S3Affected

References

106666vdb-entry
https://kb.juniper.net/JSA10906

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.