2019-01 Security Bulletin: Junos OS: EX2300 and EX3400: High disk I/O operations may disrupt the communication between RE and PFE (CVE-2019-0009)

Product Affected:

This issue affects Junos OS 15.1X53, 18.1, 18.2. Affected platforms: EX2300 and EX3400 series.

Problem:

On EX2300 and EX3400 series, high disk I/O operations may disrupt the communication between the routing engine (RE) and the packet forwarding engine (PFE).

In a virtual chassis (VC) deployment, this issue disrupts communication between the VC members.

This issue does not affect other Junos platforms.

Affected releases are Junos OS on EX2300 and EX3400 series:

15.1X53 versions prior to 15.1X53-D590;
18.1 versions prior to 18.1R2-S2, 18.1R3;
18.2 versions prior to 18.2R2.

This issue was seen during production usage.

This issue has been assigned CVE-2019-0009.

Solution:

The following software releases have been updated to resolve this specific issue: Junos OS 15.1X53-D113, 15.1X53-D590, 18.1R2-S2, 18.1R3, 18.2R2, 18.3R1, and all subsequent releases.

This issue is being tracked as PR 1355593 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround:

Avoid performing operation that may generate high disk I/O.

Limiting the access to the device to only trusted administrators from trusted administrative networks or hosts would minimize the risk.

Implementation:

Software Releases, patches and updates are available at https://www.juniper.net/support/downloads/.

Modification History:

2019-01-09: Initial Publication.

CVSS Score:

5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Severity Level:

Medium

Severity Assessment:

Information for how Juniper Networks uses CVSS can be found at KB 16446 "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Knowledge Base