CVE-2015-3006: Junos: QFX Series: Insufficient entropy on QFX3500 and QFX3600 platforms when the system boots up

Published Feb 28, 2020

Updated

On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOMINTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for some time, but immediately after boot, the entropy is very low. This issue only affects the QFX3500 and QFX3600 switches. No other Juniper Networks products or platforms are affected by this weak entropy vulnerability.

Affected Software

16 affected components

Juniper Junos=12.2x50-d10

Juniper Junos=12.2x50-d20

Juniper Junos=12.2x50-d41.1

Juniper Junos=12.2x50-d42.1

Juniper Junos=12.2x50-d56.1

Juniper Junos=13.1x50-d10

Juniper Junos=13.1x50-d25

Juniper Junos=13.2x51-d15

Juniper Junos=13.2x51-d20

Juniper Junos=13.2x51-d20.2

Juniper Junos=13.2x51-d21

Juniper Junos=13.2x52-d10

Juniper Junos=13.2x52-d5

Juniper Junos=14.1x53

Juniper QFX3500

Juniper QFX3600

Remediation

Information

The following software releases have been updated to resolve this specific issue: Junos OS 12.2X50-D70 13.1X50-D30 13.2X51-D25 13.2X51-D30 13.2X52-D15 14.1X53-D10, and all subsequent releases. It is recommended to regenerate SSH keys or self signed certificates.

Event History

Feb 28, 2020

CVE Published

via MITRE·10:26 PM

Data Sourced

via MITRE·10:26 PM

RemedyDescriptionSeverity

Frequently Asked Questions

What is CVE-2015-3006?

CVE-2015-3006 is a vulnerability found on the QFX3500 and QFX3600 platforms that leads to weak or duplicate SSH keys or self-signed SSL/TLS certificates due to insufficient entropy.

Which platforms are affected by CVE-2015-3006?

CVE-2015-3006 affects the QFX3500 and QFX3600 platforms.

How does CVE-2015-3006 impact the affected platforms?

CVE-2015-3006 can result in the generation of weak or duplicate SSH keys or self-signed SSL/TLS certificates.

What is the severity of CVE-2015-3006?

CVE-2015-3006 has a severity rating of 6.5, considered medium.

Where can I find more information about CVE-2015-3006?

More information about CVE-2015-3006 can be found at the Juniper Networks Knowledge Base: https://kb.juniper.net/JSA10678