CVE-2019-0043 : Security Advisory and Response

In April 2019, Juniper Networks identified a vulnerability in Junos OS that could lead to denial of service attacks by crashing the routing protocol daemon (RPD) process upon receiving a specific SNMP packet.

Understanding CVE-2019-0043

This CVE involves a vulnerability in Junos OS that allows attackers to repeatedly crash the RPD process by sending a carefully crafted SNMP packet, resulting in extended denial of service.

What is CVE-2019-0043?

The vulnerability in Junos OS allows attackers to crash the RPD process by sending a specific SNMP packet in MPLS environments, causing the daemon to restart continuously.

The Impact of CVE-2019-0043

The vulnerability poses a high availability impact as it can lead to prolonged denial of service by repeatedly crashing the RPD process.

Technical Details of CVE-2019-0043

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability allows attackers to crash the RPD process in Junos OS by sending a carefully crafted SNMP packet in MPLS environments.

Affected Systems and Versions

SRX Series: Versions prior to 12.1X46-D77, 12.3X48-D75, 15.1X49-D141, 15.1X49-D144, 15.1X49-D150
EX/QFX series: Versions prior to 14.1X53-D48
QFX5200/QFX5110 Series: Versions prior to 15.1X53-D234
QFX10K Series: Versions prior to 15.1X53-D68
NFX Series: Versions prior to 15.1X53-D471
EX2300/EX3400 Series: Versions prior to 15.1X53-D590
ACX Series: Version 15.1X54

Exploitation Mechanism

Attackers exploit the vulnerability by continuously sending a specific SNMP packet, causing the RPD process to crash and restart, leading to denial of service.

Mitigation and Prevention

To address CVE-2019-0043, follow these mitigation steps:

Immediate Steps to Take

Disable SNMP (disabled by default)
Utilize edge filtering with source-address validation (uRPF, etc.)
Implement access control lists (ACLs)
Use SNMPv3 authentication to limit access to trusted hosts

Long-Term Security Practices

Regularly update Junos OS to the patched versions
Monitor network traffic for any suspicious SNMP activities

Patching and Updates

Update to the following software releases to resolve the issue: 12.1X46-D77, 12.3R12-S10, 12.3X48-D75, 14.1X53-D48, 15.1F6-S11, 15.1R4-S9, 15.1R7-S2, 15.1X49-D141, 15.1X49-D144, 15.1X49-D150, 15.1X53-D234, 15.1X53-D471, 15.1X53-D590, 15.1X53-D68, 16.1R3-S10, 16.1R4-S11, 16.1R6-S5, 16.1R7, 16.1X65-D48, 16.2R2-S6, 17.1R2-S8, 17.1R3, 17.2R1-S7, 17.2R3, 17.2X75-D102, 17.2X75-D110, 17.2X75-D92, 17.3R3, 17.4R1-S4, 17.4R2, 18.1R1-S1, 18.1R2-S1, 18.1R3, 18.2R1, 18.2X75-D10, 18.3R1, and subsequent releases.