Crafted packets destined to the management interface (fxp0) of an SRX340 or SRX345 services gateway may create a denial of service (DoS) condition due to buffer space exhaustion.

This issue only affects the SRX340 and SRX345 services gateways. No other products or platforms are affected by this vulnerability.

Affected releases are Juniper Networks Junos OS:

• 15.1X49 versions prior to 15.1X49-D160 on SRX340/SRX345;
• 17.3 on SRX340/SRX345;
• 17.4 versions prior to 17.4R2-S3, 17.4R3 on SRX340/SRX345;
• 18.1 versions prior to 18.1R3-S1 on SRX340/SRX345;
• 18.2 versions prior to 18.2R2 on SRX340/SRX345;
• 18.3 versions prior to 18.3R1-S2, 18.3R2 on SRX340/SRX345.

This issue does not affect Junos OS releases prior to 15.1X49 on any platform.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

The following log message may be displayed when the device is in this condition:

Administrators can monitor buffer space utilization by executing the command:

This issue was seen during production usage.

This issue has been assigned  CVE-2019-0038 .
 

The following software releases have been updated to resolve this specific issue: Junos OS 15.1X49-D160, 17.4R2-S3, 17.4R3, 18.1R3-S1, 18.2R2, 18.3R1-S2, 18.3R2, 18.4R1, and all subsequent releases.

This issue is being tracked as PR  1377152  which is visible on the Customer Support website.

Note: Juniper SIRT's  policy  is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
 

Software Releases, patches and updates are available at  https://www.juniper.net/support/downloads/ .
 

There are no known workarounds for this issue.

Limiting the access to the device's management interface only from trusted administrative networks or hosts would minimize the risk.
 

• 2019-04-10: Initial Publication
• 2019-04-24: Added recommendation to limit access to device's management interface
   

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process. [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team