bugtraq - NetScreen Security Advisory 57739

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20030731203940.GC656@netscreen.com>
Date: Thu, 31 Jul 2003 13:39:41 -0700
From: NetScreen Security Response Team <security-alert@...screen.com>
To: bugtraq@...urityfocus.com
Subject: NetScreen Security Advisory 57739

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Title: NetScreen Advisory 57739

Date: 30 July 2003

Impact: Potential Denial of Service of Security Device

Affected Products: NetScreen Firewall/VPN products running ScreenOS
4.0.1r1 through 4.0.1r6 and 4.0.3r1 and 4.0.3r2

Unaffected Products: NetScreen IDP, NetScreen Firewall/VPN products
running ScreenOS 3 and below, 4.0.0, 4.0.1r7 and higher, 4.0.2, 4.0.3r3
and higher

Max Risk: Medium

Summary:

A malicious user connecting to a NetScreen Security Device with a
certain TCP option set can cause it to reboot, causing a temporary
service outage.

Details:

Due to a bug in ScreenOS, a non-privileged user who attempts to connect
to a NetScreen Security Device management IP from the range of addresses
permitted by the manager-ip feature with a particular TCP window option
setting can cause the system to crash and reboot.  This issue affects
Telnet and WebUI (HTTP/HTTPS) management, as well as WebAuth
authentication service (HTTP/HTTPS).

SSH management connections to the NetScreen device are not susceptible,
nor are the classic policy-driven firewall authentication (ProxyAuth)
connections.  Additionally, traffic passing through the device does not
crash the device, only particular TCP sessions terminating on the device
itself.

Recommended Actions:

Restrict administrative access to known administrator hosts and/or
subnets with the 'set admin manager-ip ...' feature.

Activate ScreenOS' anti-spoofing feature to prevent spoofed manager IP's
from non-manager subnets.

Turn off management on all interfaces not facing the IT management
network (NOC/SOC/etc).

Use ProxyAuth instead of WebAuth for policy authentication.

Use SSH instead of Telnet to remotely manage your NetScreen firewall.

Upgrade to maintenance release r7 or later of ScreenOS 4.0.1, or
maintenance release r3 or later of ScreenOS 4.0.3.

Please refer to the following URL for more information:

http://www.netscreen.com/services/security/alerts/advisory-57739.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (Darwin)

iD8DBQE/KXTCUUsgh8bp1hsRAqbQAJ9KuCg2TPXgFUlGKUuLwy17wSYXwgCcClKB
ZcE5Vyb8g12Q7MSBY4Cugo4=
=sSlC
-----END PGP SIGNATURE-----