fkie_cve-2015-3006
Vulnerability from fkie_nvd
Published
2020-02-28 23:15
Modified
2024-11-21 02:28
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for some time, but immediately after boot, the entropy is very low. This issue only affects the QFX3500 and QFX3600 switches. No other Juniper Networks products or platforms are affected by this weak entropy vulnerability.
References
cve@mitre.orghttps://kb.juniper.net/JSA10678Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://kb.juniper.net/JSA10678Vendor Advisory
Impacted products
Vendor Product Version
juniper junos 12.2x50
juniper junos 12.2x50
juniper junos 12.2x50
juniper junos 12.2x50
juniper junos 12.2x50
juniper junos 13.1x50
juniper junos 13.1x50
juniper junos 13.2x51
juniper junos 13.2x51
juniper junos 13.2x51
juniper junos 13.2x51
juniper junos 13.2x52
juniper junos 13.2x52
juniper junos 14.1x53
juniper qfx3500 -
juniper qfx3600 -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos:12.2x50:d10:*:*:*:*:*:*",
              "matchCriteriaId": "497821DC-B070-4EE9-93DB-49352477423A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:12.2x50:d20:*:*:*:*:*:*",
              "matchCriteriaId": "8C5F0149-58AC-4863-8FA5-3CB5B97BE4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:12.2x50:d41.1:*:*:*:*:*:*",
              "matchCriteriaId": "3D56B992-5713-4656-94B7-943A3119B25D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:12.2x50:d42.1:*:*:*:*:*:*",
              "matchCriteriaId": "6436A50E-74AF-4886-8ECD-2AA37202A089",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:12.2x50:d56.1:*:*:*:*:*:*",
              "matchCriteriaId": "4F921F54-8B9D-481E-A3D8-DC485BFE2965",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:13.1x50:d10:*:*:*:*:*:*",
              "matchCriteriaId": "EC28512D-DD4A-4BD3-B717-B7989A10F0F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:13.1x50:d25:*:*:*:*:*:*",
              "matchCriteriaId": "6863F885-C2A2-48AA-969E-CC4E6BFA2C2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:13.2x51:d15:*:*:*:*:*:*",
              "matchCriteriaId": "3947A516-2054-48B3-ADFD-3CF88EC2288D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:13.2x51:d20:*:*:*:*:*:*",
              "matchCriteriaId": "D0951235-4A0A-4200-A7B1-9FF4540A3755",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:13.2x51:d20.2:*:*:*:*:*:*",
              "matchCriteriaId": "0CE9A629-DE43-4F7C-B93E-18BC6EC10FED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:13.2x51:d21:*:*:*:*:*:*",
              "matchCriteriaId": "9E3A9AB1-202A-4480-8FFD-872C79325854",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:13.2x52:d10:*:*:*:*:*:*",
              "matchCriteriaId": "1864A2D2-1FE6-4282-BB47-F5F18296D5B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:13.2x52:d5:*:*:*:*:*:*",
              "matchCriteriaId": "8572251A-9A0B-4C59-8AE4-691D0E0EE53B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:14.1x53:-:*:*:*:*:*:*",
              "matchCriteriaId": "6FEF5DD8-B0B2-4ED2-B38F-CE870485AB8C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A336BD3-4AB0-4E9E-8AD5-E6413A5A53FC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F4D44B0-E6CE-4380-8712-AC832DBCB424",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for some time, but immediately after boot, the entropy is very low. This issue only affects the QFX3500 and QFX3600 switches. No other Juniper Networks products or platforms are affected by this weak entropy vulnerability."
    },
    {
      "lang": "es",
      "value": "En las plataformas QFX3500 y QFX3600, el n\u00famero de bytes recopilados desde la fuente de entrop\u00eda de RANDOM_INTERRUPT cuando los arranques del dispositivo son insuficientes, conllevando posiblemente a claves SSH d\u00e9biles o duplicadas o a certificados SSL/TLS auto-firmados. La entrop\u00eda aumenta despu\u00e9s que el sistema ha estado funcionando durante alg\u00fan tiempo, pero inmediatamente despu\u00e9s del arranque, la entrop\u00eda es muy lenta. Este problema s\u00f3lo afecta a los switches QFX3500 y QFX3600. Ning\u00fan otro producto o plataforma de Juniper Networks est\u00e1 afectada por esta vulnerabilidad de debilidad de la entrop\u00eda."
    }
  ],
  "id": "CVE-2015-3006",
  "lastModified": "2024-11-21T02:28:29.740",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "cve@mitre.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-02-28T23:15:11.010",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://kb.juniper.net/JSA10678"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://kb.juniper.net/JSA10678"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-331"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.