CVE-2019-0048: EX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may fail

Published Jul 11, 2019

Updated

On EX4300 Series switches with TCAM optimization enabled, incoming multicast traffic matches an implicit loopback filter rule first, since it has high priority. This rule is meant for reserved multicast addresses 224.0.0.x, but incorrectly matches on 224.x.x.x. Due to this bug, when a firewall filter is applied on the loopback interface, other firewall filters might stop working for multicast traffic. The command 'show firewall filter' can be used to confirm whether the filter is working. This issue only affects the EX4300 switch. No other products or platforms are affected by this vulnerability. This issue affects: Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D51, 14.1X53-D115 on EX4300 Series; 17.1 versions prior to 17.1R3 on EX4300 Series; 17.2 versions prior to 17.2R3-S2 on EX4300 Series; 17.3 versions prior to 17.3R3-S3 on EX4300 Series; 17.4 versions prior to 17.4R2-S5, 17.4R3 on EX4300 Series; 18.1 versions prior to 18.1R3-S1 on EX4300 Series; 18.2 versions prior to 18.2R2 on EX4300 Series; 18.3 versions prior to 18.3R2 on EX4300 Series.

Affected Software

87 affected components

Juniper JUNOS=14.1x53

Juniper JUNOS=14.1x53-d10

Juniper JUNOS=14.1x53-d15

Juniper JUNOS=14.1x53-d16

Juniper JUNOS=14.1x53-d25

Juniper JUNOS=14.1x53-d26

Juniper JUNOS=14.1x53-d27

Juniper JUNOS=14.1x53-d30

Juniper JUNOS=14.1x53-d35

Juniper JUNOS=14.1x53-d40

Juniper JUNOS=14.1x53-d45

Juniper JUNOS=14.1x53-d48

Juniper JUNOS=14.1x53-d49

Juniper Ex4300-24p

Juniper Ex4300-24p-s

Juniper Ex4300-24t

Juniper Ex4300-24t-s

Juniper Ex4300-32f

Juniper Ex4300-32f-dc

Juniper Ex4300-32f-s

Juniper Ex4300-48mp

Juniper Ex4300-48mp-s

Juniper Ex4300-48p

Juniper Ex4300-48p-s

Juniper Ex4300-48t

Juniper Ex4300-48t-afi

Juniper Ex4300-48t-dc

Juniper Ex4300-48t-dc-afi

Juniper Ex4300-48t-s

Juniper Ex4300-48tafi

Juniper Ex4300-48tdc

Juniper Ex4300-48tdc-afi

Juniper JUNOS=17.1

Juniper JUNOS=17.1-r1

Juniper JUNOS=17.1-r2-s1

Juniper JUNOS=17.1-r2-s10

Juniper JUNOS=17.1-r2-s2

Juniper JUNOS=17.1-r2-s3

Juniper JUNOS=17.1-r2-s4

Juniper JUNOS=17.1-r2-s5

Juniper JUNOS=17.1-r2-s6

Juniper JUNOS=17.1-r2-s7

Juniper JUNOS=17.2

Juniper JUNOS=17.2-r1

Juniper JUNOS=17.2-r1-s2

Juniper JUNOS=17.2-r1-s4

Juniper JUNOS=17.2-r1-s7

Juniper JUNOS=17.2-r2

Juniper JUNOS=17.2-r2-s6

Juniper JUNOS=17.2-r2-s7

Juniper JUNOS=17.2-r3-s1

Juniper JUNOS=17.3

Juniper JUNOS=17.3-r1

Juniper JUNOS=17.3-r2

Juniper JUNOS=17.3-r2-s1

Juniper JUNOS=17.3-r2-s2

Juniper JUNOS=17.3-r3-s1

Juniper JUNOS=17.3-r3-s2

Juniper JUNOS=17.4

Juniper JUNOS=17.4-r1

Juniper JUNOS=17.4-r1-s1

Juniper JUNOS=17.4-r1-s2

Juniper JUNOS=17.4-r1-s4

Juniper JUNOS=17.4-r2

Juniper JUNOS=17.4-r2-s1

Juniper JUNOS=17.4-r2-s2

Juniper JUNOS=17.4-r2-s3

Juniper JUNOS=17.4-r2-s4

Juniper JUNOS=18.1

Juniper JUNOS=18.1-r1

Juniper JUNOS=18.1-r2

Juniper JUNOS=18.1-r2-s1

Juniper JUNOS=18.1-r2-s2

Juniper JUNOS=18.2

Juniper JUNOS=18.2-r1

Juniper JUNOS=18.2-r1-s3

Juniper JUNOS=18.2-r1-s4

Juniper JUNOS=18.2-r2-s1

Juniper JUNOS=18.2-r2-s2

Juniper JUNOS=18.2-r2-s3

Juniper JUNOS=18.2-r2-s4

Juniper JUNOS=18.3

Juniper JUNOS=18.3-r1

Juniper JUNOS=18.3-r1-s1

Juniper JUNOS=18.3-r1-s2

Juniper JUNOS=18.3-r1-s3

Juniper JUNOS=18.3-r1-s4

Remediation

Patch Available

https://kb.juniper.net/JSA10942

Information

The following software releases have been updated to resolve this specific issue: 14.1X53-D51, 14.1X53-D115, 17.1R3, 17.2R3-S2, 17.3R3-S3, 17.4R2-S5, 17.4R3, 18.1R3-S1, 18.2R2, 18.3R2, 18.4R1, and all subsequent releases.

Event History

Jul 11, 2019

CVE Published

via MITRE·07:40 PM

Data Sourced

via MITRE·07:40 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2019-0048?

CVE-2019-0048 has a medium severity rating due to its potential impact on network performance and multicast traffic filtering.

How do I fix CVE-2019-0048?

To mitigate CVE-2019-0048, it is recommended to update your Juniper EX4300 Series switches to a fixed version of the Junos OS.

What affects the vulnerability CVE-2019-0048?

CVE-2019-0048 affects EX4300 Series switches running Junos versions 14.1x53 and specific 17.x and 18.x releases.

Is CVE-2019-0048 exploitable remotely?

Yes, CVE-2019-0048 can be exploited remotely by sending specially crafted multicast traffic.

Who is impacted by CVE-2019-0048?

Organizations using impacted Juniper EX4300 Series switches with the specified versions of Junos OS are vulnerable to CVE-2019-0048.