Dan Goodin

**Name of the Vulnerable Software and Affected Versions** Juniper ScreenOS versions 6.2.0r15 through 6.2.0r18 Juniper ScreenOS versions 6.3.0r12 before 6.3.0r12b Juniper ScreenOS versions 6.3.0r13 before 6.3.0r13b Juniper ScreenOS versions 6.3.0r14 before 6.3.0r14b Juniper ScreenOS versions 6.3.0r15 before 6.3.0r15b Juniper ScreenOS versions 6.3.0r16 before 6.3.0r16b Juniper ScreenOS versions 6.3.0r17 before 6.3.0r17b Juniper ScreenOS versions 6.3.0r18 before 6.3.0r18b Juniper ScreenOS versions 6.3.0r19 before 6.3.0r19b Juniper ScreenOS versions 6.3.0r20 before 6.3.0r21 **Description** The issue is related to weaknesses in the authentication procedure of the ScreenOS operating system. This allows a remote attacker to gain administrative access by entering a specially crafted password during an SSH or TELNET session. **Recommendations** For Juniper ScreenOS versions 6.2.0r15 through 6.2.0r18, update to a version outside of this range. For Juniper ScreenOS versions 6.3.0r12 before 6.3.0r12b, update to 6.3.0r12b or later. For Juniper ScreenOS versions 6.3.0r13 before 6.3.0r13b, update to 6.3.0r13b or later. For Juniper ScreenOS versions 6.3.0r14 before 6.3.0r14b, update to 6.3.0r14b or later. For Juniper ScreenOS versions 6.3.0r15 before 6.3.0r15b, update to 6.3.0r15b or later. For Juniper ScreenOS versions 6.3.0r16 before 6.3.0r16b, update to 6.3.0r16b or later. For Juniper ScreenOS versions 6.3.0r17 before 6.3.0r17b, update to 6.3.0r17b or later. For Juniper ScreenOS versions 6.3.0r18 before 6.3.0r18b, update to 6.3.0r18b or later. For Juniper ScreenOS versions 6.3.0r19 before 6.3.0r19b, update to 6.3.0r19b or later. For Juniper ScreenOS versions 6.3.0r20 before 6.3.0r21, update to 6.3.0r21 or later. As a temporary workaround, consider restricting access to SSH and TELNET sessions until a patch is available.