critical
9.8
CWE
908
Advisory Published
Updated

CVE-2019-0006: Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configuration

First published: Wed Jan 09 2019(Updated: )

A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, QFX and MX Series devices in a Virtual Chassis configuration. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. This issue only occurs when the crafted packet it destined to the device. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47 on EX and QFX Virtual Chassis Platforms; 15.1 versions prior to 15.1R7-S3 all Virtual Chassis Platforms 15.1X53 versions prior to 15.1X53-D50 on EX and QFX Virtual Chassis Platforms.

Credit: sirt@juniper.net

Affected SoftwareAffected VersionHow to fix
Juniper Junos=14.1x53
Juniper Junos=14.1x53-d10
Juniper Junos=14.1x53-d15
Juniper Junos=14.1x53-d16
Juniper Junos=14.1x53-d25
Juniper Junos=14.1x53-d26
Juniper Junos=14.1x53-d27
Juniper Junos=14.1x53-d30
Juniper Junos=14.1x53-d35
Juniper Junos=14.1x53-d40
Juniper Junos=14.1x53-d45
Juniper Junos=14.1x53-d46
Juniper Junos=14.1x53-r1
Juniper EX2200-C
Juniper EX2200
Juniper EX2300-24T
Juniper EX2300-C
Juniper EX3300
Juniper EX3400
Juniper EX Series
Juniper EX4300-24T
juniper ex4500-vc
Juniper EX Series
Juniper EX4600
Juniper EX4650
Juniper EX Series
Juniper EX8208
Juniper EX Series
Juniper EX Series
Juniper EX9208
Juniper EX9214
Juniper EX9251
Juniper EX9253
Juniper QFX10002-60C
Juniper QFX10008
Juniper QFX10016
Juniper QFX3500
Juniper QFX3600-I
Juniper QFX5100
Juniper QFX5110
Juniper QFX5120
Juniper QFX5200-48Y
Juniper QFX5210-64C
Juniper Junos=15.1-r1
Juniper Junos=15.1-r2
Juniper Junos=15.1-r3
Juniper Junos=15.1-r4
Juniper Junos=15.1-r5
Juniper Junos=15.1-r6
Juniper Junos=15.1x53-d20
Juniper Junos=15.1x53-d21
Juniper Junos=15.1x53-d30
Juniper Junos=15.1x53-d32
Juniper Junos=15.1x53-d33
Juniper Junos=15.1x53-d34
Juniper Junos=15.1x53-d50

Remedy

The following Junos OS releases have been updated to resolve this specific issue: 14.1X53-D47, 15.1R7-S3, 16.1R1 and all subsequent releases.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is CVE-2019-0006?

    CVE-2019-0006 is a vulnerability that can be triggered by a crafted HTTP packet and can result in a crash of the fxpc daemon or potential remote code execution.

  • Which devices are affected by CVE-2019-0006?

    All EX, QFX, and MX Series devices in a Virtual Chassis configuration running Juniper JUNOS 14.1x53 are affected.

  • How severe is CVE-2019-0006?

    CVE-2019-0006 has a severity rating of 9.8 (critical).

  • How can I fix CVE-2019-0006?

    To fix CVE-2019-0006, update your Juniper JUNOS software to a version that is not vulnerable.

  • Where can I find more information about CVE-2019-0006?

    More information about CVE-2019-0006 can be found at the following references: [1](http://www.securityfocus.com/bid/106666), [2](https://kb.juniper.net/JSA10906).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203