Vulnerability Details : CVE-2019-0042
Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allow an attacker with physical access to an existing domain connected Windows system to bypass SRX firewall policies, or trigger a Denial of Service (DoS) condition for the network.
Vulnerability category: Denial of service
Products affected by CVE-2019-0042
- cpe:2.3:a:juniper:identity_management_service:*:*:*:*:*:windows:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-0042
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 23 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-0042
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
1.9
|
LOW | AV:L/AC:M/Au:N/C:N/I:N/A:P |
3.4
|
2.9
|
NIST | |
|
5.7
|
MEDIUM | CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H |
0.5
|
4.7
|
Juniper Networks, Inc. | |
|
4.2
|
MEDIUM | CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
0.5
|
3.6
|
NIST |
CWE ids for CVE-2019-0042
-
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.Assigned by: sirt@juniper.net (Secondary)
-
The product does not release or incorrectly releases a resource before it is made available for re-use.Assigned by: sirt@juniper.net (Secondary)
-
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.Assigned by: sirt@juniper.net (Secondary)
References for CVE-2019-0042
-
https://kb.juniper.net/JSA10934
Juniper Networks - 2019-04 Security Bulletin: Incorrect messages from Juniper Identity Management Service (JIMS) can trigger Denial of Service or firewall bypass conditions for SRX series devices (CVEMitigation;Vendor Advisory
Jump to