SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Firewall)  >   Juniper ScreenOS Vendors:   NetScreen
NetScreen ScreenOS Can Be Crashed By Remote Users Sending Packets With Certain TCP Window Sizes
SecurityTracker Alert ID:  1007329
SecurityTracker URL:  http://securitytracker.com/id/1007329
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jul 29 2003
Impact:   Denial of service via network
Exploit Included:  Yes  
Version(s): 4.0.3r2; Confirmed on NetScreen 204 and 208
Description:   A denial of service vulnerability was reported in NetScreen's ScreenOS. A remote user can cause the firewall device to crash and reboot.

It is reported that a remote user can cause the NetScreen 204 and 208 devices running ScreenOS 4.0.3r2 to crash by connecting to a management port (e.g., ssh, telnet, http) using a certain TCP Windows size. Only systems that have one or more management ports enabled are affected.

As a demonstration exploit, you can reportedly set the following Windows 2000 SP1/SP2 registry values:

\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
New DWORD Value

Tcp1323Opts
HEX
3

TcpWindowSize
Decimal
131400

Impact:   A remote user can connect to an enabled management port to cause the system to crash and reboot.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.netscreen.com/ (Links to External Site)
Cause:   Exception handling error

Message History:   This archive entry has one or more follow-up message(s) listed below.
Jul 31 2003 (Vendor Issues Fix) Re: NetScreen ScreenOS Can Be Crashed By Remote Users Sending Packets With Certain TCP Window Sizes
NetScreen has issued a fix and clarifies/corrects some details.



 Source Message Contents

Subject:  NetScreen ScreenOS 4.0.3r2 DOS




There is a vulnerability in NetScreen's latest ScreenOS
that allows a malicious user to create a denial of
service attack remotely.

This has only been confirmed with the following
operating systems and NetScreen hardware.

Microsoft Windows 2000 Professional SP1 and SP2
NetScreen 204 and 208

By modifying the TCP Window size in the registry in W2K
a user can cause a NetScreen 20x running ScreenOS
4.0.3r2 to core dump the ASIC and reboot.

This only affects devices that have management services
such as Web, Telnet, or SSH enabled on an interface.

When a user tries to connect to one of the management
ports with the registry settings below the NetScreen
crashes.

\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
New DWORD Value

Tcp1323Opts
HEX
3

TcpWindowSize
Decimal
131400

Papa Love Mambo Research Group
plm at ioerror.org

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC