NetScreen Non-IP Traffic Firewall Bypass Vulnerability

Bugtraq ID:	8150
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 09 2003 12:00AM
Updated:	Jul 09 2003 12:00AM
Credit:	Discovery of this issue is credited to new InquisiTeam <[email protected]>.
Vulnerable:	NetScreen ScreenOS 4.0.3 NetScreen ScreenOS 4.0.1 NetScreen ScreenOS 4.0 -DIAL NetScreen ScreenOS 4.0 NetScreen ScreenOS 3.1.1 r2 NetScreen ScreenOS 3.1 r9 NetScreen ScreenOS 3.1 r2 NetScreen ScreenOS 3.1 r1 NetScreen ScreenOS 3.1 NetScreen ScreenOS 3.0.3 r1.1 NetScreen ScreenOS 3.0.3 NetScreen ScreenOS 3.0.2 NetScreen ScreenOS 3.0.1 r2 NetScreen ScreenOS 3.0.1 r1 NetScreen ScreenOS 3.0.1 NetScreen ScreenOS 3.0 r4 NetScreen ScreenOS 3.0 r3 NetScreen ScreenOS 3.0 r2 NetScreen ScreenOS 3.0 r1 NetScreen ScreenOS 3.0 NetScreen ScreenOS 2.10 r4 NetScreen ScreenOS 2.10 r3 NetScreen ScreenOS 2.8 r1 NetScreen ScreenOS 2.8 NetScreen ScreenOS 2.7.1 r3 NetScreen ScreenOS 2.7.1 r2 NetScreen ScreenOS 2.7.1 r1 NetScreen ScreenOS 2.7.1 NetScreen ScreenOS 2.6.1 r5 NetScreen ScreenOS 2.6.1 r4 NetScreen ScreenOS 2.6.1 r3 NetScreen ScreenOS 2.6.1 r2 NetScreen ScreenOS 2.6.1 r1 NetScreen ScreenOS 2.6.1 NetScreen ScreenOS 2.6 NetScreen ScreenOS 2.5 r6 NetScreen ScreenOS 2.5 r2 NetScreen ScreenOS 2.5 r1 NetScreen ScreenOS 2.5 NetScreen ScreenOS 2.1 r7 NetScreen ScreenOS 2.1 r6 NetScreen ScreenOS 2.1 NetScreen ScreenOS 2.0.1 r8 NetScreen ScreenOS 1.73 r2 NetScreen ScreenOS 1.73 r1 NetScreen ScreenOS 1.66 r2 NetScreen ScreenOS 1.66 NetScreen ScreenOS 1.64 NetScreen ScreenOS 1.7
Not Vulnerable:

NetScreen Non-IP Traffic Firewall Bypass Vulnerability

It has been alleged that it is possible for remote users to bypass NetScreen firewalls. Reports have stated that any non-IP or ARP traffic will bypass the firewall without being logged. This is reported to occur in 20x and 50x models when run in bridge mode, though this is not conclusive.

NetScreen Non-IP Traffic Firewall Bypass Vulnerability

There is no exploit required.

NetScreen Non-IP Traffic Firewall Bypass Vulnerability

Solution:
The vendor has responded to this issue, stating that fixes will be available during the week of July 14, 2003. See referenced vendor advisory for more details.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

NetScreen Non-IP Traffic Firewall Bypass Vulnerability

References:

• NetScreen Advisory 57605 (Netscreen)
  
• NetScreen Advisory 57605 Clarification (NetScreen)
  
• NetScreen Homepage (NetScreen)