NetScreen ScreenOS Firewall Policy Bypass Vulnerability
BID:2523
Info
NetScreen ScreenOS Firewall Policy Bypass Vulnerability
| Bugtraq ID: | 2523 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 26 2001 12:00AM |
| Updated: | Mar 26 2001 12:00AM |
| Credit: | Reported to bugtraq in a vendor advisory dated March 23, 2001 |
| Vulnerable: |
NetScreen ScreenOS 2.5 NetScreen ScreenOS 2.1 NetScreen ScreenOS 1.66 NetScreen ScreenOS 1.64 |
| Not Vulnerable: |
NetScreen ScreenOS 2.5 r6 NetScreen ScreenOS 2.0.1 r8 NetScreen ScreenOS 1.66 r2 |
Discussion
NetScreen ScreenOS Firewall Policy Bypass Vulnerability
NetScreen is a line of internet security appliances inetgrating firewall, VPN and traffic management features.
Versions of ScreenOS, the inbuild OS of two models in the NetScreen line (NetScreen-10 & -100) contain a flaw which may permit some packets, of a type which has been denied, to enter the DMZ.
As a result of this vulnerability, potentially malicious packets of a type which has been prohibited in the device's policy may, to a limited extent, reach the DMZ network.
Further details of this vulnerability were not made available.
NetScreen is a line of internet security appliances inetgrating firewall, VPN and traffic management features.
Versions of ScreenOS, the inbuild OS of two models in the NetScreen line (NetScreen-10 & -100) contain a flaw which may permit some packets, of a type which has been denied, to enter the DMZ.
As a result of this vulnerability, potentially malicious packets of a type which has been prohibited in the device's policy may, to a limited extent, reach the DMZ network.
Further details of this vulnerability were not made available.
Exploit / POC
NetScreen ScreenOS Firewall Policy Bypass Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
NetScreen ScreenOS Firewall Policy Bypass Vulnerability
Solution:
(the following is excerpted from the vendor advisory dated March 23 , 2001):
Getting Fixed Software
If you have registered your product with NetScreen and have a service contract, you can simply download the software from: http://www.netscreen.com/support/updates.html
You will be prompted for your User ID and Password. Enter the whole or part of your company name as your User ID and enter your registered NetScreen device serial number as the password.
If you have not yet registered your product with NetScreen, you will need to contact NetScreen Technical Support for special instructions on how to obtain the fixed software. NetScreen Technical Support can be reached from 8 a.m. to 5 p.m. pacific time Monday through Friday excluding weekends and observed holidays. You may contact them via email at
[email protected] or by phone at 408-730-6000
Please reference this Advisory title as evidence of your entitlement to the fixed software version.
NetScreen Authorized Partners have access to NetScreen software versions and may also be a channel through which to obtain the new release.
Solution:
(the following is excerpted from the vendor advisory dated March 23 , 2001):
Getting Fixed Software
If you have registered your product with NetScreen and have a service contract, you can simply download the software from: http://www.netscreen.com/support/updates.html
You will be prompted for your User ID and Password. Enter the whole or part of your company name as your User ID and enter your registered NetScreen device serial number as the password.
If you have not yet registered your product with NetScreen, you will need to contact NetScreen Technical Support for special instructions on how to obtain the fixed software. NetScreen Technical Support can be reached from 8 a.m. to 5 p.m. pacific time Monday through Friday excluding weekends and observed holidays. You may contact them via email at
[email protected] or by phone at 408-730-6000
Please reference this Advisory title as evidence of your entitlement to the fixed software version.
NetScreen Authorized Partners have access to NetScreen software versions and may also be a channel through which to obtain the new release.
References
NetScreen ScreenOS Firewall Policy Bypass Vulnerability
References:
References:
- NetScreen Homepage (NetScreen)
- NetScreen software download form (NetScreen)