CVE-2019-0064 Junos OS: SRX5000 Series: flowd process crash due to receipt of specific TCP packet

High 7.5 Published 9 Oct 2019 Updated 17 Sep 2024

Attackers can cause extended denial of service on Juniper SRX5000 devices by sending specific TCP packets when TCP RST is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-0064?

CVE-2019-0064 is a high-severity denial of service vulnerability in Juniper Junos, published on 9 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

On SRX5000 Series devices, if 'set security zones security-zone <zone> tcp-rst' is configured, the flowd process may crash when a specific TCP packet is received by the device and triggers a new session. The process restarts automatically. However, receipt of a constant stream of these TCP packets may result in an extended Denial of Service (DoS) condition on the device. This issue affects Juniper Networks Junos OS: 18.2R3 on SRX 5000 Series; 18.4R2 on SRX 5000 Series; 19.2R1 on SRX 5000 Series.

Which versions are affected by CVE-2019-0064?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2019-0064?

No fix has been published for CVE-2019-0064 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-0064 being exploited?

There is no known exploitation of CVE-2019-0064 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-6vpf-6mrv-x8cr.