PT-2015-3194 · Juniper Networks · Screenos

Published 2015-10-19 · Updated 2016-12-08 · CVE-2015-7750

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Juniper Netscreen and ScreenOS Firewall products with ScreenOS versions prior to 6.3.0r13-dnd1 Juniper Netscreen and ScreenOS Firewall products with ScreenOS versions 6.3.0r14 through 6.3.0r18 before 6.3.0r18-dnc1 Juniper Netscreen and ScreenOS Firewall products with ScreenOS version 6.3.0r19

Description The issue is related to the L2TP packet processing functionality, which allows remote attackers to cause a denial of service via a crafted L2TP packet. This is due to insufficient input validation in the ScreenOS operating system.

Recommendations For versions prior to 6.3.0r13-dnd1, update to version 6.3.0r13-dnd1 or later. For versions 6.3.0r14 through 6.3.0r18, update to version 6.3.0r18-dnc1 or later. For version 6.3.0r19, update to a version later than 6.3.0r19. As a temporary workaround, consider restricting the processing of L2TP packets until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00564

CVE-2015-7750

Affected Products

Screenos

References · 5

• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10704 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7750 · Security Note
• https://bdu.fstec.ru/vul/2016-00564 · Security Note
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10704 · Note
• http://securitytracker.com/id/1033832 · Note