NetScreen ScreenOS TCP Window Size Remote Denial Of Service Vulnerability
BID:8302
Info
NetScreen ScreenOS TCP Window Size Remote Denial Of Service Vulnerability
| Bugtraq ID: | 8302 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 29 2003 12:00AM |
| Updated: | Jul 29 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Papa loves Mambo <[email protected]>. |
| Vulnerable: |
NetScreen ScreenOS 4.0.3 r2 NetScreen ScreenOS 4.0.3 r1 NetScreen ScreenOS 4.0.1 r6 NetScreen ScreenOS 4.0.1 r5 NetScreen ScreenOS 4.0.1 r4 NetScreen ScreenOS 4.0.1 r3 NetScreen ScreenOS 4.0.1 r2 NetScreen ScreenOS 4.0.1 r1 |
| Not Vulnerable: |
NetScreen ScreenOS 4.0.3 r3 NetScreen ScreenOS 4.0.1 r7 |
Discussion
NetScreen ScreenOS TCP Window Size Remote Denial Of Service Vulnerability
NetScreen ScreenOS has been reported prone to a vulnerability that may allow a remote user to trigger a denial of service condition in an affected appliance.
It has been reported that by modifying system configuration values that control the TCP window size, an attacker may connect to and trigger a denial of service in an appliance that is running a vulnerable version of ScreenOS.
This issue only affects some ScreenOS 4.0.1rx and 4.0.3rx releases. NetScreen IDP, NetScreen Firewall/VPN products running ScreenOS 3.x and earlier, 4.0.0, and 4.0.2 are not vulnerable. The vendor has supplied upgrades for affected versions.
NetScreen ScreenOS has been reported prone to a vulnerability that may allow a remote user to trigger a denial of service condition in an affected appliance.
It has been reported that by modifying system configuration values that control the TCP window size, an attacker may connect to and trigger a denial of service in an appliance that is running a vulnerable version of ScreenOS.
This issue only affects some ScreenOS 4.0.1rx and 4.0.3rx releases. NetScreen IDP, NetScreen Firewall/VPN products running ScreenOS 3.x and earlier, 4.0.0, and 4.0.2 are not vulnerable. The vendor has supplied upgrades for affected versions.
Exploit / POC
NetScreen ScreenOS TCP Window Size Remote Denial Of Service Vulnerability
Modifying registry values on a Windows 2000 system, to reflect the proof of concept below, and connecting to an affected appliance is sufficient to demonstrate the issue:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
New DWORD Value
Tcp1323Opts
HEX
3
Modifying registry values on a Windows 2000 system, to reflect the proof of concept below, and connecting to an affected appliance is sufficient to demonstrate the issue:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
New DWORD Value
Tcp1323Opts
HEX
3
Solution / Fix
NetScreen ScreenOS TCP Window Size Remote Denial Of Service Vulnerability
Solution:
The vendor has addressed this issue in ScreenOS 4.0.1r7/4.0.3r3 releases and later. Users are advised to upgrade.
Solution:
The vendor has addressed this issue in ScreenOS 4.0.1r7/4.0.3r3 releases and later. Users are advised to upgrade.
References
NetScreen ScreenOS TCP Window Size Remote Denial Of Service Vulnerability
References:
References:
- NetScreen Homepage (NetScreen)
- NetScreen ScreenOS 4.0.3r2 DOS (Papa loves Mambo
- NetScreen Security Advisory 57739 (NetScreen Security Response Team