CVE-2019-16300 : What You Need to Know

Open Network Operating System (ONOS) version 1.14 is affected by a vulnerability in the access control application (org.onosproject.acl) that could lead to unintended code execution absence when interacting with other applications.

Understanding CVE-2019-16300

This CVE identifies a flaw in ONOS 1.14 that impacts the handling of HOST_REMOVED event types within the host event listener of the access control application.

What is CVE-2019-16300?

An issue in ONOS 1.14 where the access control application fails to handle HOST_REMOVED event types properly, potentially causing unintended code execution absence when used with other applications.

The Impact of CVE-2019-16300

The vulnerability could result in the absence of intended code execution, affecting the overall security and functionality of the ONOS system.

Technical Details of CVE-2019-16300

The technical aspects of the vulnerability in ONOS 1.14 and its implications.

Vulnerability Description

The access control application (org.onosproject.acl) in ONOS 1.14 does not correctly manage HOST_REMOVED event types within its host event listener, leading to potential code execution issues.

Affected Systems and Versions

Product: Open Network Operating System (ONOS)
Version: 1.14

Exploitation Mechanism

The vulnerability can be exploited by triggering HOST_REMOVED event types within the host event listener, potentially causing unintended code execution absence.

Mitigation and Prevention

Steps to address and prevent the CVE-2019-16300 vulnerability.

Immediate Steps to Take

Update ONOS to a patched version that addresses the access control application issue.
Monitor system logs for any unusual activity related to HOST_REMOVED event types.

Long-Term Security Practices

Regularly update and patch ONOS and its applications to mitigate potential vulnerabilities.
Implement network segmentation and access controls to limit the impact of security breaches.

Patching and Updates

Apply security patches and updates provided by ONOS to ensure the access control application properly handles event types like HOST_REMOVED.