CVE-2019-0042

Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allow an attacker with physical access to an existing domain connected Windows system to bypass SRX firewall policies, or trigger a Denial of Service (DoS) condition for the network.

CVSS v3 4.2 MEDIUM
CVSS v2.0 1.9 LOW

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://kb.juniper.net/JSA10934	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:juniper:identity_management_service:*:*:*:*:*:windows:*:*

History

28 Oct 2021, 12:46

Type	Values Removed	Values Added
CWE	~~CWE-20~~	NVD-CWE-noinfo

Information

Published : 2019-04-10 20:29

Updated : 2023-12-10 12:59

NVD link : CVE-2019-0042

Mitre link : CVE-2019-0042

CVE.ORG link : CVE-2019-0042

JSON object : View

Products Affected

juniper

identity_management_service

CWE

NVD-CWE-noinfo CWE-305

Authentication Bypass by Primary Weakness

CWE-404

Improper Resource Shutdown or Release

CWE-669

Incorrect Resource Transfer Between Spheres

{"id": "CVE-2019-0042", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.7, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 0.5}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.5}]}, "published": "2019-04-10T20:29:00.977", "references": [{"url": "https://kb.juniper.net/JSA10934", "tags": ["Mitigation", "Vendor Advisory"], "source": "sirt@juniper.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-305"}, {"lang": "en", "value": "CWE-404"}, {"lang": "en", "value": "CWE-669"}]}], "descriptions": [{"lang": "en", "value": "Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allow an attacker with physical access to an existing domain connected Windows system to bypass SRX firewall policies, or trigger a Denial of Service (DoS) condition for the network."}, {"lang": "es", "value": "El Juniper Identity Management Service (JIMS) para versiones de Windows anteriores a 1.1.4 puede enviar un mensaje de manera inapropiada a las puertas de enlace de servicios SRX asociadas. Esto puede permitir que un atacante con acceso f\u00edsico a un dominio existente conectado al sistema Windows omita las pol\u00edticas de firewall SRX, o desencadene una condici\u00f3n de Denegaci\u00f3n de Servicio (DoS) para la red."}], "lastModified": "2021-10-28T12:46:38.773", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:juniper:identity_management_service:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "00195B94-8F8C-466E-BE59-F41061E9CC0D", "versionEndExcluding": "1.1.4"}], "operator": "OR"}]}], "sourceIdentifier": "sirt@juniper.net"}