Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2005.0081 -- US-CERT VU#409555
Juniper Unknown Denial of Service Vulnerability
27 January 2005
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: all Juniper routers running JUNOS
Publisher: US-CERT
Operating System: JUNOS 5.x, 6.x, 7.x
Impact: Denial of Service
Access: Remote/Unauthenticated
CVE Names: CAN-2004-0467
Original Bulletin: http://www.kb.cert.org/vuls/id/409555
- --------------------------BEGIN INCLUDED TEXT--------------------
OVERVIEW
Juniper routers will become severely disrupted when attacked with
specially-crafted network packets of an unknown type.
I. DESCRIPTION
Juniper routers running JUNOS have a vulnerability in which specially-crafted
network packets can cause normal operation of affected routers to be severely
disrupted.
According to Juniper's security bulletin PSN-2005-01-010:
This vulnerability could be exploited either by a directly attached
neighboring device or by a remote attacker that can deliver certain
packets to the router. Routers running vulnerable JUNOS software
are susceptible regardless of the router's configuration. It is
not possible to use firewall filters to protect vulnerable routers.
This vulnerability is specific to Juniper Networks routers running
JUNOS software. Routers that do not run JUNOS software are not
susceptible to this vulnerability. ...
This problem exists in all releases of JUNOS software built prior
to January 7, 2005.
US-CERT is aware this issue is known to affect M-series & T-series Juniper
routers.
II. IMPACT
A remote, unauthenticated attacker may cause severe operational disruption
to affected Juniper routers. Affected routers will suffer an effective denial
of routing service when this vulnerability is exploited.
III. SOLUTION
Please see the vendor statement with relevant patches. Users registered at
Juniper's support site should visit
https://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2005-01-009&actionBtn=Search
According to Juniper, it is not possible to use network filters to protect
vulnerable routers. Vulnerable routers must be updated in order to effectively
mitigate this vulnerability.
CREDIT
Juniper has thanked Qwest Communication Software Certification team for
bringing this issue to their attention.
This document was written by Jeff S Havrilla.
- -------------------------------------------------------------------------------
Juniper Networks Information for VU#409555
==========================================
Bulletin Number: PSN-2005-01-010
Title: Security Vulnerability in JUNOS Software (CERT/CC VU#409555)
Products Affected: All Juniper routers running JUNOS Software
Platforms Affected: JUNOS 5.x, JUNOS 6.x, JUNOS 7.x, Security
Issue:
Juniper Networks has identified a serious security issue within
our JUNOS Software.
This vulnerability could be exploited either by a directly attached
neighboring device or by a remote attacker that can deliver certain
packets to the router. Routers running vulnerable JUNOS software
are susceptible regardless of the router's configuration. It is
not possible to use firewall filters to protect vulnerable routers.
This vulnerability is specific to Juniper Networks routers running
JUNOS software. Routers that do not run JUNOS software are not
susceptible to this vulnerability. Juniper Networks is not aware
of any actual or attempted exploit of this vulnerability.
This problem exists in all releases of JUNOS software built prior
to January 7, 2005. Juniper Networks would like to thank Qwest
Communications and their Software Certification team for bringing
this issue to our attention.
Solution:
JUNOS software has been modified to address this vulnerability.
All versions of JUNOS software built on or after January 22, 2005
contain the modified code. Software built between January 7 and
January 22 may contain the modified code, depending on the
specific JUNOS release.
Solution Implementation:
All customers are strongly encouraged to upgrade their software to
a release that contains the modified code. Pointers to software
releases that contain the corrected code can be found in the Related
Links section below. Customers can also contact Juniper Network's
Technical Assistance Center for download information.
Risk Level: High
Risk Assessment:
Both directly-attached and remote attackers can severely disrupt
normal operation of the routing platform.
CERT Addendum:
Related Links (available to registered Juniper customers only):
Juniper Security Bulletin PSN-2005-01-010
Title: Security Vulnerability in JUNOS Software (CERT/CC VU#409555)
https://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2005-01-010&actionBtn=Search
Software Upgrade Roadmap
https://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2005-01-009&actionBtn=Search
US-CERT is tracking this issue as VU#409555. CERT/CC has been notified by
Juniper that they are tracking this issue internally under PR/8245. Please
contact the Juniper Technical Assistance Center (JTAC) for more information:
http://www.juniper.net/support/requesting-support.html
mailto:support@juniper.net
+1-888-314-JTAC (within the United States, Canada, or Mexico)
+1-408-745-9500 (from other countries)
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBQfhDryh9+71yA2DNAQJb9wQAliVqFoQO0JLWrGr56nfeutGZpbSV7kRo
EBStyRPMabM1sBU6dEEvuh50Y/Y3uFC1wDU5p85HyV200PXsZXyCD2Cp3XBfzic5
cO2y2+KJDf+UAVsDg2In7kHGuC/ajNAU8PMQvFg5iTsHlBGLhxGrJWSPgb+vqjpM
4pFOM//ngOI=
=aVzx
-----END PGP SIGNATURE-----