-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Title: NetScreen Advisory 57739 Date: 30 July 2003 Impact: Potential Denial of Service of Security Device Affected Products: NetScreen Firewall/VPN products running ScreenOS 4.0.1r1 through 4.0.1r6 and 4.0.3r1 and 4.0.3r2 Unaffected Products: NetScreen IDP, NetScreen Firewall/VPN products running ScreenOS 3 and below, 4.0.0, 4.0.1r7 and higher, 4.0.2, 4.0.3r3 and higher Max Risk: Medium Summary: A malicious user connecting to a NetScreen Security Device with a certain TCP option set can cause it to reboot, causing a temporary service outage. Details: Due to a bug in ScreenOS, a non-privileged user who attempts to connect to a NetScreen Security Device management IP from the range of addresses permitted by the manager-ip feature with a particular TCP window option setting can cause the system to crash and reboot. This issue affects Telnet and WebUI (HTTP/HTTPS) management, as well as WebAuth authentication service (HTTP/HTTPS). SSH management connections to the NetScreen device are not susceptible, nor are the classic policy-driven firewall authentication (ProxyAuth) connections. Additionally, traffic passing through the device does not crash the device, only particular TCP sessions terminating on the device itself. Recommended Actions: Restrict administrative access to known administrator hosts and/or subnets with the 'set admin manager-ip ...' feature. Activate ScreenOS' anti-spoofing feature to prevent spoofed manager IP's from non-manager subnets. Turn off management on all interfaces not facing the IT management network (NOC/SOC/etc). Use ProxyAuth instead of WebAuth for policy authentication. Use SSH instead of Telnet to remotely manage your NetScreen firewall. Upgrade to maintenance release r7 or later of ScreenOS 4.0.1, or maintenance release r3 or later of ScreenOS 4.0.3. Please refer to the following URL for more information: http://www.netscreen.com/services/security/alerts/advisory-57739.txt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (Darwin) iD8DBQE/KXTCUUsgh8bp1hsRAqbQAJ9KuCg2TPXgFUlGKUuLwy17wSYXwgCcClKB ZcE5Vyb8g12Q7MSBY4Cugo4= =sSlC -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Thu Jul 31 2003 - 13:57:34 PDT