CVE-2019-0036 Explained : Impact and Mitigation

When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" are silently ignored, potentially leading to unexpected outcomes.

Understanding CVE-2019-0036

This CVE affects various versions of Juniper Networks Junos OS, where specific firewall filter terms are disregarded during configuration.

What is CVE-2019-0036?

CVE-2019-0036 is a vulnerability in Junos OS that causes terms named "internal-n" to be ignored in stateless firewall filters, matching all packets unexpectedly.

The Impact of CVE-2019-0036

The issue affects Junos OS versions prior to and including 12.3, potentially leading to security risks and unexpected network behavior.

Technical Details of CVE-2019-0036

This section provides detailed technical information about the vulnerability.

Vulnerability Description

When terms named "internal-n" are used in stateless firewall filters, they are silently disregarded, matching all packets.

Affected Systems and Versions

Junos OS versions 12.1X46, 12.3X48, and 12.3 are affected.
Various custom versions of 14.1X53, 15.1, 15.1X49, 15.1X53, 16.1, 16.2, 17.1, 17.2, 17.3, 17.4, 18.1, 18.2, 18.2X75, 18.3, and 18.4 are also impacted.

Exploitation Mechanism

Juniper SIRT has not detected any malicious exploitation related to this vulnerability.

Mitigation and Prevention

Learn how to mitigate and prevent the CVE-2019-0036 vulnerability.

Immediate Steps to Take

Avoid configuring firewall filter names in the format: internal-n.

Long-Term Security Practices

Regularly update Junos OS to the fixed versions mentioned in the solution section.

Patching and Updates

Apply the software releases provided in the solution section to resolve the issue.