CVE-2019-0073

09.10.2019, 20:15

The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D180; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.6 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
juniper	CNA	6.6 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 8%

Vendor	Product	Version
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	15.1x49:x49
juniper	junos	17.3
juniper	junos	17.3:r1
juniper	junos	17.3:r2
juniper	junos	17.3:r2-s1
juniper	junos	17.3:r2-s2
juniper	junos	17.3:r3
juniper	junos	17.3:r3-s1
juniper	junos	17.3:r3-s2
juniper	junos	17.3:r3-s3
juniper	junos	17.3:r3-s4
juniper	junos	17.3:r3-s5
juniper	junos	17.3:r3-s6
juniper	junos	17.4
juniper	junos	17.4:r1
juniper	junos	17.4:r1-s1
juniper	junos	17.4:r1-s2
juniper	junos	17.4:r1-s4
juniper	junos	17.4:r1-s6
juniper	junos	17.4:r1-s7
juniper	junos	17.4:r2
juniper	junos	17.4:r2-s1
juniper	junos	17.4:r2-s3
juniper	junos	17.4:r2-s4
juniper	junos	17.4:r2-s5
juniper	junos	17.4:r2-s6
juniper	junos	17.4:r2-s7
juniper	junos	18.1
juniper	junos	18.1:r2
juniper	junos	18.1:r2-s1
juniper	junos	18.1:r2-s2
juniper	junos	18.1:r2-s4
juniper	junos	18.1:r3
juniper	junos	18.1:r3-s2
juniper	junos	18.1:r3-s3
juniper	junos	18.1:r3-s4
juniper	junos	18.1:r3-s5
juniper	junos	18.1:r3-s6
juniper	junos	18.1:r3-s7
juniper	junos	18.2
juniper	junos	18.2:r1-s5
juniper	junos	18.2:r2
juniper	junos	18.2:r2-s1
juniper	junos	18.2:r2-s2
juniper	junos	18.2:r2-s3
juniper	junos	18.2:r2-s4
juniper	junos	18.3
juniper	junos	18.3:r1
juniper	junos	18.3:r1-s1
juniper	junos	18.3:r1-s2
juniper	junos	18.3:r1-s3
juniper	junos	18.4
juniper	junos	18.4:r1
juniper	junos	18.4:r1-s2

𝑥

= Vulnerable software versions

Common Weakness Enumeration

References

https://kb.juniper.net/JSA10974