Security Incident Response
Security Incident Response
Important Announcement about ScreenOS®
12.17.15

IMPORTANT JUNIPER SECURITY ANNOUNCEMENT

 

CUSTOMER UPDATE: DECEMBER 20, 2015

 

Administrative Access (CVE-2015-7755) only affects ScreenOS 6.3.0r17 through 6.3.0r20. VPN Decryption (CVE-2015-7756) only affects ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20.

 

We strongly recommend that all customers update their systems and apply these patched releases with the highest priority.

 

POSTED BY BOB WORRALL, SVP CHIEF INFORMATION OFFICER ON DECEMBER 17, 2015

 

 

Juniper is committed to maintaining the integrity and security of our products and wanted to make customers aware of critical patched releases we are issuing today to address vulnerabilities in devices running ScreenOS® software. 

 

During a recent internal code review, Juniper discovered unauthorized code in ScreenOS that could allow a knowledgeable attacker to gain administrative access to NetScreen® devices and to decrypt VPN connections. Once we identified these vulnerabilities, we launched an investigation into the matter, and worked to develop and issue patched releases for the latest versions of ScreenOS.

 

At this time, we have not received any reports of these vulnerabilities being exploited; however, we strongly recommend that customers update their systems and apply the patched releases with the highest priority.

 

On behalf of the entire Juniper Security Response Team, please know that we take this matter very seriously and are making every effort to address these issues. More information and guidance on applying this update to systems can be found in the Juniper Security Advisories (JSAs) available on our Security Incident Response website at http://advisory.juniper.net.  

 

Bob Worrall

SVP Chief Information Officer

 

Q: Why did this issue require an out-of-cycle security advisory?
Juniper is committed to maintaining the integrity and security of our products. Consistent with industry best practices, this means releasing patches for products in a timely manner to maintain customer security. We believed that it was in our customers’ best interest to issue these patched releases with the highest priority.

 

We strongly recommend that all customers update their systems and apply these patched releases as soon as possible.

 

Q: What devices do these issues impact?

Administrative access (CVE-2015-7755) only affects devices running ScreenOS 6.3.0r17 through 6.3.0r20.

VPN Decryption (CVE-2015-7756) only affects devices running ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20.

We strongly recommend that all customers update their systems and apply the patched releases with the highest priority

 

Q: Is the SRX or any other Junos®-based system affected by these issues?

These vulnerabilities are specific to ScreenOS. We have no evidence that the SRX or other devices running Junos are impacted at this time.

 

Q: Who can I contact if I have additional questions about my system?

Customers with questions about their systems should e-mail us at sirt@juniper.net

 

 

 

 

 

12.17.15
ralvarado@clearslide.com

Hello,  Are there a workaround for the decrypting vpn connections part of the vulnerablity? 

 

Thanks,

-Rico 

12.17.15
digger33

The original version of this article mentioned username 'system'; was this in error, or was it removed for some other reason? How can customers identify a successful attack through the logs?

 

Update: Found the reference, it was in the KB, not the advisory: https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=SIRT_1&actp=LIST&smlogin=true

12.18.15
sebastianw

I'm curious about how that code was added and who added it? Will there be further information?

12.18.15
zauber

Hello!

 

In regards to "unauthorized remote administrative access to the device over SSH or telnet", is it safe to assume that if we restrict access through those ports, we are implementing a workaround?

For some companies, this time of the year is critical, so patching could be an issue.  So in order to prevent this unauthorized access, we can restrict access and patch later.

 

Thank you....

12.18.15
gleduc@mail.sdsu.edu

Does exploitation require that management be enabled on an exposed interface?