Juniper EX4300 TCAM Optimization Multicast Traffic 7pk security

Summaryinfo

A vulnerability identified as critical has been detected in Juniper EX4300. Affected is an unknown function of the component TCAM Optimization. The manipulation as part of Multicast Traffic leads to 7pk security. This vulnerability is documented as CVE-2019-0048. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Juniper EX4300 (affected version not known) and classified as critical. This issue affects some unknown functionality of the component TCAM Optimization. The manipulation as part of a Multicast Traffic leads to a 7pk security vulnerability. Using CWE to declare the problem leads to CWE-254. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

On EX4300 Series switches with TCAM optimization enabled, incoming multicast traffic matches an implicit loopback filter rule first, since it has high priority. This rule is meant for reserved multicast addresses 224.0.0.x, but incorrectly matches on 224.x.x.x. Due to this bug, when a firewall filter is applied on the loopback interface, other firewall filters might stop working for multicast traffic. The command 'show firewall filter' can be used to confirm whether the filter is working. This issue only affects the EX4300 switch. No other products or platforms are affected by this vulnerability. This issue affects: Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D51, 14.1X53-D115 on EX4300 Series; 17.1 versions prior to 17.1R3 on EX4300 Series; 17.2 versions prior to 17.2R3-S2 on EX4300 Series; 17.3 versions prior to 17.3R3-S3 on EX4300 Series; 17.4 versions prior to 17.4R2-S5, 17.4R3 on EX4300 Series; 18.1 versions prior to 18.1R3-S1 on EX4300 Series; 18.2 versions prior to 18.2R2 on EX4300 Series; 18.3 versions prior to 18.3R2 on EX4300 Series.

The weakness was released 07/11/2019 (Website). The advisory is shared at kb.juniper.net. The identification of this vulnerability is CVE-2019-0048 since 10/11/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1211 for this issue.

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Juniper

Name

• EX4300

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion