CVE-2019-0035 : What You Need to Know
Learn about CVE-2019-0035, a vulnerability in Junos OS that enables root password recovery on OAM volumes. Find out the impacted systems, exploitation risks, and mitigation steps.
This CVE involves a vulnerability in Junos OS that allows for root password recovery on OAM volumes when the 'set system ports console insecure' option is enabled.
Understanding CVE-2019-0035
This CVE identifies a security issue in Junos OS that could potentially lead to unauthorized administrative access through physical console access.
What is CVE-2019-0035?
When the 'set system ports console insecure' option is activated in Junos OS, it can allow for the root password to be changed, enabling unauthorized access to the system.
The Impact of CVE-2019-0035
The vulnerability poses a medium-severity risk with high impacts on confidentiality, integrity, and availability, especially for systems with physical access.
Technical Details of CVE-2019-0035
This section delves into the specifics of the vulnerability, affected systems, and how it can be exploited.
Vulnerability Description
Enabling 'set system ports console insecure' in Junos OS can lead to unauthorized root password changes via OAM volumes, potentially granting unauthorized administrative access.
Affected Systems and Versions
- Junos OS versions 15.1 to 18.3 are affected by this vulnerability.
- Versions prior to specific releases for each branch are vulnerable.
Exploitation Mechanism
The exploit requires physical access to the console and knowledge of the OAM volume location to change the root password.
Mitigation and Prevention
To address CVE-2019-0035, immediate steps and long-term security practices are crucial.
Immediate Steps to Take
- Update Junos OS to the fixed releases mentioned in the solution section.
- Limit physical access to the recovery console to trusted administrators.
Long-Term Security Practices
- Regularly update Junos OS to the latest secure versions.
- Implement strict access controls to prevent unauthorized physical access to critical systems.
Patching and Updates
Ensure that Junos OS is updated to versions 15.1F6-S12, 15.1R7-S3, 15.1X49-D160, and subsequent releases to mitigate this vulnerability.