CVE-2019-0009

Junos OS: EX2300 and EX3400: High disk I/O operations may disrupt the communication between RE and PFE

Description

On EX2300 and EX3400 series, high disk I/O operations may disrupt the communication between the routing engine (RE) and the packet forwarding engine (PFE). In a virtual chassis (VC) deployment, this issue disrupts communication between the VC members. This issue does not affect other Junos platforms. Affected releases are Junos OS on EX2300 and EX3400 series: 15.1X53 versions prior to 15.1X53-D590; 18.1 versions prior to 18.1R2-S2, 18.1R3; 18.2 versions prior to 18.2R2.

Remediation

Solution:

The following software releases have been updated to resolve this specific issue: Junos OS 15.1X53-D113, 15.1X53-D590, 18.1R2-S2, 18.1R3, 18.2R2, 18.3R1, and all subsequent releases.

Workaround:

Avoid performing operation that may generate high disk I/O. Limiting the access to the device to only trusted administrators from trusted administrative networks or hosts would minimize the risk.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 3.0 •

CVSS 2.0 •

EPSS 0.05%

Vendor Advisory juniper.net

Affected: Juniper Networks Junos OS

References

Link	Tags
https://kb.juniper.net/JSA10909	vendor advisory
http://www.securityfocus.com/bid/106548	vdb entry third party advisory

Frequently Asked Questions

What is the severity of CVE-2019-0009?: CVE-2019-0009 has been scored as a medium severity vulnerability.
How to fix CVE-2019-0009?: To fix CVE-2019-0009: The following software releases have been updated to resolve this specific issue: Junos OS 15.1X53-D113, 15.1X53-D590, 18.1R2-S2, 18.1R3, 18.2R2, 18.3R1, and all subsequent releases.
Is CVE-2019-0009 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2019-0009 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2019-0009?: CVE-2019-0009 affects Juniper Networks Junos OS.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.