full-disclosure - Layered Defense Research Advisory: Juniper Netscreen Firewall Cross-Site-Scripting (XSS) event log injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 01 Oct 2008 21:57:05 -0400
From: Deral Heiland <dh@...ereddefense.com>
To: ull-disclosure@...ts.grok.org.uk
Subject: Layered Defense Research Advisory: Juniper
 Netscreen Firewall Cross-Site-Scripting (XSS) event log injection

==================================================
Layered Defense Research Advisory 1 October 2008
==================================================
1) Affected Product
Juniper Netscreen Firewall
ScreenOS version 5.4.0r9.0
==================================================
2) Severity Rating:
Low - Moderate
Impact: Potential system compromises but requires user interaction.
==================================================
3) Description of Vulnerability
A Cross-Site Scripting (XSS) Injection vulnerability was discovered 
within the Juniper Netscreen firewall NetOS version 5.4.0r9.0. The 
vulnerability is caused by failure to validate input from the web 
interface login, and telnet session login. This makes it possible for 
an attacker to inject javascript as part of the user name during 
login. The javascript is then stored in the device event logs. When 
the event logs are viewed within the Netscreen web console the 
javascript is executed. A successful attack would allow an attacker 
to run JavaScript on the computer system connecting to the netscreen 
web management console which could lead to system compromise.
==================================================
4) Solution
Upgrade to ScreenOS versions 5.4r10, 6.0r6, 6.1r2, and later. If 
unsure if your product is vulnerable  it is recommended that you 
contact the vendor.
==================================================
5) Time Table:
04/07/2008 Reported Vulnerability to Vendor.
04/23/2008 Vendor acknowledged the vulnerability
10/01/2008 Vendor advisory published
==================================================
6) Credits Discovered by Deral Heiland, www.LayeredDefense.com
==================================================
7) Reference
https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-009&viewMode=view
==================================================
8) About Layered Defense Layered Defense, Is a group of security 
professionals that work together on ethical Research,
Testing and Training within the information security arena. 
http://www.layereddefense.com
================================================== 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/