bugtraq - Re: NetScreen ScreenOS 4.0.3r2 DOS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: 30 Jul 2003 09:48:30 -0500
From: "seclist_at_wiresec.net" <seclist@...esec.net>
To: Papa loves Mambo <plm@...rror.org>
Subject: Re: NetScreen ScreenOS 4.0.3r2 DOS


Did you notify Netscreen? 


On Tue, 2003-07-29 at 11:27, Papa loves Mambo wrote:
> There is a vulnerability in NetScreen's latest ScreenOS
> that allows a malicious user to create a denial of
> service attack remotely.
> 
> This has only been confirmed with the following
> operating systems and NetScreen hardware.
> 
> Microsoft Windows 2000 Professional SP1 and SP2
> NetScreen 204 and 208
> 
> By modifying the TCP Window size in the registry in W2K
> a user can cause a NetScreen 20x running ScreenOS
> 4.0.3r2 to core dump the ASIC and reboot.
> 
> This only affects devices that have management services
> such as Web, Telnet, or SSH enabled on an interface.
> 
> When a user tries to connect to one of the management
> ports with the registry settings below the NetScreen
> crashes.
> 
> \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
> New DWORD Value
> 
> Tcp1323Opts
> HEX
> 3
> 
> TcpWindowSize
> Decimal
> 131400
> 
> Papa Love Mambo Research Group
> plm at ioerror.org