Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2006.0300 -- [Win]
Juniper Networks SSL-VPN Client Buffer Overflow
28 April 2006
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Juniper SSL-VPN JuniperSetup Control
Publisher: eEye Digital Security
Operating System: Windows Server 2003
Windows XP
Windows 2000
Windows NT
Impact: Execute Arbitrary Code/Commands
Access: Remote/Unauthenticated
Original Bulletin:
http://www.juniper.net/support/security/alerts/PSN-2006-03-013.txt
http://www.eeye.com/html/research/advisories/AD20060424.html
- --------------------------BEGIN INCLUDED TEXT--------------------
Juniper Networks SSL-VPN Client Buffer Overflow
Release Date:
April 25, 2006
Date Reported:
February 27, 2006
Patch Development Time (In Days):
57 Days
Severity:
High (Remote Code Execution)
Vendor:
Juniper Networks
Software Affected:
Juniper SSL-VPN JuniperSetup Control
Operating Systems Affected:
Windows NT 4.0 (All versions)
Windows 2000 (All versions)
Windows XP (All versions)
Windows 2003 (All versions)
Overview:
eEye Digital Security has discovered a critical vulnerability in Juniper
Networks SSL-VPN Client ActiveX Control. JuniperSetup.ocx ActiveX
control is automatically loaded throgh the web interface of Juniper
Networks SSL-VPN. There is an exploitable buffer overflow in the
handling a parameter of ActiveX control that will allow a remote
attacker to reliably overwrite the stack with arbitrary data and execute
arbitrary code though the web browser.
Technical Details:
The vulnerability exists in JuniperSetupDLL.dll which is loaded from
JuniperSetup.ocx ActiveX control. If the long string is specified in the
ProductName parameter as follows, the stack based buffer overflow
happens in a function of JuniperSetupDLL.dll.
The vulnerable function is as follows.
.text:04F15783 ; int __stdcall sub_4F15783_ilvdlp(char
*szProductName,LPCSTR lpValueName,LPBYTE lpData,LPDWORD lpcbData)
.text:04F15783 sub_4F15783_ilvdlp proc near
.text:04F15783
.text:04F15783 SubKey = byte ptr -10Ch
.text:04F15783 Type = dword ptr -8
.text:04F15783 hKey = dword ptr -4
...
.text:04F157BF lea eax, [ebp+SubKey]
.text:04F157C5 push offset szUninstallRegistryKey
.text:04F157CA push eax
.text:04F157CB call strcpy
.text:04F157D0 push [ebp+szProductName]
.text:04F157D3 lea eax, [ebp+SubKey]
.text:04F157D9 push eax
.text:04F157DA call strcat
.data:04F1EA10 ; char szUninstallRegistryKey[]
.data:04F1EA10 szUninstallRegistryKey db
'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\',0
The first argument (szProductName) of this function is the product name
which is used to create the uninstall registry key. The value field of
"ProductName" parameter is passed into the szProductName, copied into
the local buffer "SubKey" using strcat() function without any boundary
checking. So, if we pass the specially crafted "ProductName" parameter,
we can overwrite the return address in the stack and execute arbitrary
code. This is straight classical stack based buffer overflow
vulnerability.
Protection:
Retina Network Security Scanner has been updated to identify this
vulnerability.
Blink - Endpoint Vulnerability Prevention - preemptively protects from
this vulnerability.
Vendor Status:
Juniper Networks has released an alert (PSN-2006-03-013) and patch to
address this vulnerability.
Credit:
Discovery: Yuji Ukai
Greetings:
SCS guys, they are rock !
Copyright (c) 1998-2006 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express
consent of eEye. If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please email
alert@eEye.com for permission.
Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are no warranties, implied or express, with regard to this information.
In no event shall the author be liable for any direct or indirect
damages whatsoever arising out of or in connection with the use or
spread of this information. Any use of this information is at the user's
own risk.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBRFFrtSh9+71yA2DNAQJBpwP/by4zDJH36hK/GKD4EbBuhx+1Hak+LvEP
hxcvCit46ioVx+lr57n8CA08s5JqMRuJPEX166oBpzpkLO0hajOO9YzcGfNkfi2t
GDZ9u1DAIO5v7ys6FLxbTfH0b3I+NlnmIPGypESuN8F8s5Qklw6td0iwaGc7mG5d
wcjHO0LTk1U=
=987O
-----END PGP SIGNATURE-----