Junos OS: vMX series: Predictable IP ID sequence numbers vulnerability (Juniper Networks Junos OS)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.73 % · percentile 78 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- juniper
- NVD status
- Modified
Description
The vMX Series software uses a predictable IP ID Sequence Number. This leaves the system as well as clients connecting through the device susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of attack. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F5 on vMX Series.
Weaknesses (CWE)
- CWE-330 — Use of Insufficiently Random Values
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 9.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H | juniper |
| CVSS 3.0 | CRITICAL 9.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H | NVD · sirt@juniper.net (Secondary) |
| CVSS 3.0 | CRITICAL 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2019-0814
- GCVE · GCVE-0-2019-0007
CERT-FR advisories
- CERTFR-2019-AVI-014 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:juniper:junos:15.1:*:*:*:*:*:*:*cpe:2.3:o:juniper:junos:15.1:f1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:15.1:f2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:15.1:f3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:15.1:f4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:15.1:f5:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Juniper Networks · Junos OS | affected 15.1 < 15.1F5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |