SB2015121701 - Two backdoors in Juniper ScreenOS

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Authentication bypass (CVE-ID: CVE-2015-7755)

The vulnerability allows a remote attacker to bypass authentication on the target system.

The weakness exists due to presence of backdoor in Juniper ScreenOS code. A remote attacker can enter a password "<<< %s(un='%s') = %u" during a SSH or TELNET session and obtain administrative access to the device.

Successful exploitation of the vulnerability results in unauthorized access to the vulnerable system.

Note: the vulnerability was being actively exploited.

2) Information disclosure (CVE-ID: CVE-2015-7756)

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to usage of insecure encryption keys. A remote attacker can with ability to monitor VPN traffic can intercept and decrypt it.

Successful exploitation of the vulnerability results in information disclosure on the target system.

Note: the vulnerability was disclosed as part of two backdoors during internal source code audit.

Remediation

Install update from vendor's website.

References

• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&actp=search