NetScreen ScreenOS Session Timeout Unauthorized Access Vulnerability

Bugtraq ID:	9160
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 05 2003 12:00AM
Updated:	Dec 05 2003 12:00AM
Credit:	Discovery credited to tito basa.
Vulnerable:	NetScreen ScreenOS 4.0.3 r4 NetScreen ScreenOS 4.0.3 r3 NetScreen ScreenOS 4.0.3 r2 NetScreen ScreenOS 4.0.3 r1 NetScreen ScreenOS 4.0.3 NetScreen ScreenOS 4.0.2 NetScreen ScreenOS 4.0.1 r9 NetScreen ScreenOS 4.0.1 r8 NetScreen ScreenOS 4.0.1 r7 NetScreen ScreenOS 4.0.1 r6 NetScreen ScreenOS 4.0.1 r5 NetScreen ScreenOS 4.0.1 r4 NetScreen ScreenOS 4.0.1 r3 NetScreen ScreenOS 4.0.1 r2 NetScreen ScreenOS 4.0.1 r10 NetScreen ScreenOS 4.0.1 r1 NetScreen ScreenOS 4.0.1 NetScreen ScreenOS 4.0 r9 NetScreen ScreenOS 4.0 r8 NetScreen ScreenOS 4.0 r7 NetScreen ScreenOS 4.0 r6 NetScreen ScreenOS 4.0 r5 NetScreen ScreenOS 4.0 r4 NetScreen ScreenOS 4.0 r3 NetScreen ScreenOS 4.0 r2 NetScreen ScreenOS 4.0 r12 NetScreen ScreenOS 4.0 r11 NetScreen ScreenOS 4.0 r10 NetScreen ScreenOS 4.0 r1 NetScreen ScreenOS 4.0
Not Vulnerable:	NetScreen ScreenOS 5.0

NetScreen ScreenOS Session Timeout Unauthorized Access Vulnerability

It has been reported that NetScreen ScreenOS does not properly handle timed out sessions. Because of this, it may be possible for a user regain access to a previous session.

NetScreen ScreenOS Session Timeout Unauthorized Access Vulnerability

No exploit is required for this vulnerability.

NetScreen ScreenOS Session Timeout Unauthorized Access Vulnerability

Solution:
This issue has been resolved in version 5.0 of ScreenOS.

NetScreen ScreenOS Session Timeout Unauthorized Access Vulnerability

References:

• NetScreen Homepage (NetScreen)
  
• netscreen flaw? (tito )
  
• Re: netscreen flaw? (Bryan Burns )