var-202002-0863
Vulnerability from variot
On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for some time, but immediately after boot, the entropy is very low. This issue only affects the QFX3500 and QFX3600 switches. No other Juniper Networks products or platforms are affected by this weak entropy vulnerability. QFX3500 and QFX3600 The switch is vulnerable to lack of entropy.Information may be obtained.
There are security holes in Juniper Networks QFX3500 and QFX3600 switches. A remote attacker could use this vulnerability to perform a man-in-the-middle attack, gaining unauthorized access to sensitive information and systems. This aids in other attacks
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202002-0863", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "junos", "scope": "eq", "trust": 1.0, "vendor": "juniper", "version": "12.2x50" }, { "model": "junos", "scope": "eq", "trust": 1.0, "vendor": "juniper", "version": "13.1x50" }, { "model": "junos", "scope": "eq", "trust": 1.0, "vendor": "juniper", "version": "13.2x52" }, { "model": "junos", "scope": "eq", "trust": 1.0, "vendor": "juniper", "version": "13.2x51" }, { "model": "junos", "scope": "eq", "trust": 1.0, "vendor": "juniper", "version": "14.1x53" }, { "model": "junos os", "scope": null, "trust": 0.8, "vendor": "juniper", "version": null }, { "model": "networks juniper networks qfx3500", "scope": null, "trust": 0.6, "vendor": "juniper", "version": null }, { "model": "networks qfx3600", "scope": null, "trust": 0.6, "vendor": "juniper", "version": null }, { "model": "qfx3600", "scope": "eq", "trust": 0.3, "vendor": "juniper", "version": "0" }, { "model": "qfx3500", "scope": "eq", "trust": 0.3, "vendor": "juniper", "version": "0" }, { "model": "junos 14.1x50-d70", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 13.2x51-d20", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 13.2x51-d15", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 13.2x50-d20", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 13.2x50-d15.3", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 13.1x49-d55", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 13.1x49-d49", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 12.2x50-d50.1", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 12.2x50-d40.5", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 12.2x50-d20.4", "scope": null, "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 14.1x53-d10", "scope": "ne", "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 13.2x52-d15", "scope": "ne", "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 13.2x51-d30", "scope": "ne", "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 13.2x51-d25", "scope": "ne", "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 13.1x50-d30", "scope": "ne", "trust": 0.3, "vendor": "juniper", "version": null }, { "model": "junos 12.2x50-d70", "scope": "ne", "trust": 0.3, "vendor": "juniper", "version": null } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-15148" }, { "db": "BID", "id": "74020" }, { "db": "JVNDB", "id": "JVNDB-2015-008625" }, { "db": "NVD", "id": "CVE-2015-3006" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:juniper:junos:12.2x50:d10:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:12.2x50:d20:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:12.2x50:d41.1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:12.2x50:d42.1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:12.2x50:d56.1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:13.1x50:d10:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:13.1x50:d25:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:13.2x51:d15:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:13.2x51:d20:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:13.2x51:d20.2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:13.2x51:d21:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:13.2x52:d10:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:13.2x52:d5:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:juniper:junos:14.1x53:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:juniper:qfx3500:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:juniper:qfx3600:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2015-3006" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The vendor reported this issue.", "sources": [ { "db": "BID", "id": "74020" } ], "trust": 0.3 }, "cve": "CVE-2015-3006", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 6.8, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 8.0, "impactScore": 6.9, "integrityImpact": "NONE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "Single", "author": "NVD", "availabilityImpact": "None", "baseScore": 6.8, "confidentialityImpact": "Complete", "exploitabilityScore": null, "id": "JVNDB-2015-008625", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "CNVD", "availabilityImpact": "NONE", "baseScore": 6.8, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 8.0, "id": "CNVD-2020-15148", "impactScore": 6.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.8, "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "trust": 2.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "None", "baseScore": 6.5, "baseSeverity": "Medium", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "JVNDB-2015-008625", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "Low", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2015-3006", "trust": 1.0, "value": "MEDIUM" }, { "author": "cve@mitre.org", "id": "CVE-2015-3006", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "JVNDB-2015-008625", "trust": 0.8, "value": "Medium" }, { "author": "CNVD", "id": "CNVD-2020-15148", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201506-523", "trust": 0.6, "value": "MEDIUM" } ] } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-15148" }, { "db": "JVNDB", "id": "JVNDB-2015-008625" }, { "db": "NVD", "id": "CVE-2015-3006" }, { "db": "NVD", "id": "CVE-2015-3006" }, { "db": "CNNVD", "id": "CNNVD-201506-523" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for some time, but immediately after boot, the entropy is very low. This issue only affects the QFX3500 and QFX3600 switches. No other Juniper Networks products or platforms are affected by this weak entropy vulnerability. QFX3500 and QFX3600 The switch is vulnerable to lack of entropy.Information may be obtained. \n\r\n\r\nThere are security holes in Juniper Networks QFX3500 and QFX3600 switches. A remote attacker could use this vulnerability to perform a man-in-the-middle attack, gaining unauthorized access to sensitive information and systems. This aids in other attacks", "sources": [ { "db": "NVD", "id": "CVE-2015-3006" }, { "db": "JVNDB", "id": "JVNDB-2015-008625" }, { "db": "CNVD", "id": "CNVD-2020-15148" }, { "db": "BID", "id": "74020" } ], "trust": 2.43 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2015-3006", "trust": 3.3 }, { "db": "JUNIPER", "id": "JSA10678", "trust": 1.9 }, { "db": "BID", "id": "74020", "trust": 0.9 }, { "db": "JVNDB", "id": "JVNDB-2015-008625", "trust": 0.8 }, { "db": "CNVD", "id": "CNVD-2020-15148", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-201506-523", "trust": 0.6 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-15148" }, { "db": "BID", "id": "74020" }, { "db": "JVNDB", "id": "JVNDB-2015-008625" }, { "db": "NVD", "id": "CVE-2015-3006" }, { "db": "CNNVD", "id": "CNNVD-201506-523" } ] }, "id": "VAR-202002-0863", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "CNVD", "id": "CNVD-2020-15148" } ], "trust": 1.6 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "Network device" ], "sub_category": null, "trust": 0.6 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-15148" } ] }, "last_update_date": "2023-12-18T11:58:48.471000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "JSA10678", "trust": 0.8, "url": "https://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10678\u0026actp=metadata" }, { "title": "Patch for Juniper Networks QFX3500 and QFX3600 Switch Unauthorized Access Vulnerability", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchinfo/show/206549" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-15148" }, { "db": "JVNDB", "id": "JVNDB-2015-008625" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-331", "trust": 1.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2015-008625" }, { "db": "NVD", "id": "CVE-2015-3006" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.6, "url": "https://kb.juniper.net/jsa10678" }, { "trust": 1.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2015-3006" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3006" }, { "trust": 0.6, "url": "http://www.securityfocus.com/bid/74020" }, { "trust": 0.3, "url": "http://www.juniper.net/" }, { "trust": 0.3, "url": "http://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10678\u0026cat=sirt_1\u0026actp=list" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-15148" }, { "db": "BID", "id": "74020" }, { "db": "JVNDB", "id": "JVNDB-2015-008625" }, { "db": "NVD", "id": "CVE-2015-3006" }, { "db": "CNNVD", "id": "CNNVD-201506-523" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CNVD", "id": "CNVD-2020-15148" }, { "db": "BID", "id": "74020" }, { "db": "JVNDB", "id": "JVNDB-2015-008625" }, { "db": "NVD", "id": "CVE-2015-3006" }, { "db": "CNNVD", "id": "CNNVD-201506-523" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-03-03T00:00:00", "db": "CNVD", "id": "CNVD-2020-15148" }, { "date": "2015-04-09T00:00:00", "db": "BID", "id": "74020" }, { "date": "2020-03-19T00:00:00", "db": "JVNDB", "id": "JVNDB-2015-008625" }, { "date": "2020-02-28T23:15:11.010000", "db": "NVD", "id": "CVE-2015-3006" }, { "date": "2015-04-09T00:00:00", "db": "CNNVD", "id": "CNNVD-201506-523" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-03-03T00:00:00", "db": "CNVD", "id": "CNVD-2020-15148" }, { "date": "2015-04-09T00:00:00", "db": "BID", "id": "74020" }, { "date": "2020-03-19T00:00:00", "db": "JVNDB", "id": "JVNDB-2015-008625" }, { "date": "2020-03-10T13:39:00.367000", "db": "NVD", "id": "CVE-2015-3006" }, { "date": "2020-03-13T00:00:00", "db": "CNNVD", "id": "CNNVD-201506-523" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201506-523" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "QFX3500 and QFX3600 Switch vulnerabilities to lack of entropy", "sources": [ { "db": "JVNDB", "id": "JVNDB-2015-008625" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "security feature problem", "sources": [ { "db": "CNNVD", "id": "CNNVD-201506-523" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.