CVE-2019-0002 : Vulnerability Insights and Analysis
Learn about CVE-2019-0002 impacting Junos OS on Juniper Networks' EX2300 and EX3400 series switches. Find out the affected versions, exploitation details, and mitigation steps.
On EX2300 and EX3400 series, stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect. This impacts Junos OS versions 15.1X53-D590, 18.1R3, and 18.2R2.
Understanding CVE-2019-0002
This CVE involves a specific issue with stateless firewall filter rules on Juniper Networks' EX2300 and EX3400 series switches.
What is CVE-2019-0002?
This CVE identifies a problem with the configuration of stateless firewall filters on the EX2300 and EX3400 series switches when the 'policer' action is used alongside other actions. It affects certain versions of Junos OS running on these switches.
The Impact of CVE-2019-0002
The issue prevents the affected RACL group from being displayed when using the 'show pfe filter hw summary' command. Both IPv4 and IPv6 firewall filters are impacted by this configuration problem.
Technical Details of CVE-2019-0002
This section provides more technical insights into the vulnerability.
Vulnerability Description
The incomplete filtering of multiple instances of special elements in the stateless firewall filter rules leads to the 'policer' action not taking effect as expected.
Affected Systems and Versions
- Platforms: EX2300 and EX3400 series
- Product: Junos OS
- Affected Versions:
- 15.1X53 versions earlier than 15.1X53-D590
- 18.1 versions earlier than 18.1R3
- 18.2 versions earlier than 18.2R2
Exploitation Mechanism
Juniper SIRT has not detected any malicious exploitation related to this vulnerability.
Mitigation and Prevention
Here are the steps to mitigate and prevent the impact of CVE-2019-0002.
Immediate Steps to Take
- Update to the following software releases: Junos OS 15.1X53-D590, 18.1R3, 18.2R2, 18.3R1, or later.
Long-Term Security Practices
- Regularly monitor and update firewall filter configurations.
- Implement network segmentation to limit the impact of potential firewall rule misconfigurations.
Patching and Updates
Ensure that all affected systems are updated to the patched versions mentioned above.