CVE-2019-0008

QFX5000 Series, EX4300, EX4600: A stack buffer overflow vulnerability in Packet Forwarding Engine manager (FXPC) process

State: Published
Severity: 9.8 Critical
Published: Apr 10, 2019
Updated: Sep 16, 2024
Reserved: Oct 11, 2018

Read the record on cve.org

Description

A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager (FXPC) process on QFX5000 series, EX4300, EX4600 devices. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. Affected releases are Juniper Networks Junos OS on QFX 5000 series, EX4300, EX4600 are: 14.1X53; 15.1X53 versions prior to 15.1X53-D235; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2, 17.3R4; 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1, 18.1R4; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R2.

Scores

CVSS	Score	Vector	Source
3.0	9.8 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	juniper

Weaknesses

CWE-121 Stack based buffer overflow vulnerability

Affected Products

Product	Versions
Junos OSJuniper Networks	14.1X53Affected 15.1X53 to before 15.1X53-D235Affected 17.1 to before 17.1R3Affected 18.1 to before 18.1R3-S1, 18.1R4Affected 18.2 to before 18.2R2Affected 18.3 to before 18.3R2Affected
Junos OSJuniper Networks	17.2 to before 17.2R3Affected 17.3 to before 17.3R3-S2, 17.3R4Affected 17.4 to before 17.4R2-S1, 17.4R3Affected
Junos OSJuniper Networks	18.2X75 to before 18.2X75-D30Affected

References

https://kb.juniper.net/JSA10930
107897vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.