NetScreen Global PRO Policy Manager IPSec Tunnel Security Configuration Weakness

Bugtraq ID:	7379
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 16 2003 12:00AM
Updated:	Apr 16 2003 12:00AM
Credit:	This vulnerability was reported by the vendor.
Vulnerable:	NetScreen NetScreen-Global PRO Policy Manager Server 4.1 r1 NetScreen NetScreen-Global PRO Policy Manager Server 4.0 r5 NetScreen NetScreen-Global PRO Policy Manager Server 4.0 r4 NetScreen NetScreen-Global PRO Policy Manager Server 4.0 r3 NetScreen NetScreen-Global PRO Policy Manager Server 4.0 r2 NetScreen NetScreen-Global PRO Policy Manager Server 4.0 r1
Not Vulnerable:	NetScreen NetScreen-Global PRO Policy Manager Server 4.1.1

NetScreen Global PRO Policy Manager IPSec Tunnel Security Configuration Weakness

An issue has been reported in NetScreen Global PRO Policy Manager that may result in weaker than intended encryption routines used in IPSec tunnels.

The issue is due to default definitions for IPSec used by Global PRO Policy Manager. Specifically, phase 1 and phase 2 proposals using AES encrytion alogrithms will result in VPN configurations using DES encryption instead of the expected AES128.

NetScreen Global PRO Policy Manager IPSec Tunnel Security Configuration Weakness

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

NetScreen Global PRO Policy Manager IPSec Tunnel Security Configuration Weakness

Solution:
The vendor has stated that NetScreen Global PRO Policy Manger 4.1.1 will be released on May 15, 2003 which will address this vulnerability.

Registered users are advised to obtain updates, when available, from the following Web location:

http://www.netscreen.com/support/updates.html

NetScreen Global PRO Policy Manager IPSec Tunnel Security Configuration Weakness

References:

• NetScreen Security Advisory 57226 (NetScreen)