Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Network Appliances :: bt779.txt

NetScreen Security Advisory 57739

Hash: SHA1

Title: NetScreen Advisory 57739
Date: 30 July 2003
Impact: Potential Denial of Service of Security Device
Affected Products: NetScreen Firewall/VPN products running ScreenOS
4.0.1r1 through 4.0.1r6 and 4.0.3r1 and 4.0.3r2
Unaffected Products: NetScreen IDP, NetScreen Firewall/VPN products
running ScreenOS 3 and below, 4.0.0, 4.0.1r7 and higher, 4.0.2, 4.0.3r3
and higher
Max Risk: Medium
A malicious user connecting to a NetScreen Security Device with a
certain TCP option set can cause it to reboot, causing a temporary
service outage.
Due to a bug in ScreenOS, a non-privileged user who attempts to connect
to a NetScreen Security Device management IP from the range of addresses
permitted by the manager-ip feature with a particular TCP window option
setting can cause the system to crash and reboot.  This issue affects
Telnet and WebUI (HTTP/HTTPS) management, as well as WebAuth
authentication service (HTTP/HTTPS).
SSH management connections to the NetScreen device are not susceptible,
nor are the classic policy-driven firewall authentication (ProxyAuth)
connections.  Additionally, traffic passing through the device does not
crash the device, only particular TCP sessions terminating on the device

Recommended Actions:
Restrict administrative access to known administrator hosts and/or
subnets with the 'set admin manager-ip ...' feature.
Activate ScreenOS' anti-spoofing feature to prevent spoofed manager IP's
from non-manager subnets.
Turn off management on all interfaces not facing the IT management
network (NOC/SOC/etc).
Use ProxyAuth instead of WebAuth for policy authentication.
Use SSH instead of Telnet to remotely manage your NetScreen firewall.
Upgrade to maintenance release r7 or later of ScreenOS 4.0.1, or
maintenance release r3 or later of ScreenOS 4.0.3.

Please refer to the following URL for more information:
Version: GnuPG v1.2.2 (Darwin)


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH