Tag Archives: Juniper

Cisco Networking Devices Affected By Disclosed Exploits

Earlier this month Cisco made available 2 security advisories (please see below for the relevant links) that relate to the public disclosure of security vulnerabilities within their and other vendors’ products by a hacking group known as Shadow Brokers.

This group released exploits that targeted routers and firewalls from vendors such as Cisco, Juniper and Fortinet.

Further coverage of how these exploits were disclosed are available within the following links:

Cisco Acknowledges ASA Zero Day Exposed By Shadowbrokers (Threatpost)

Shadowbrokers’ Leak Has ‘Strong Connection’ To Equation Group (Threatpost)

Hacking group claims to offer cyber-weapons in online auction (Reuters)

NSA’s Hacking Group Hacked! Bunch of Private Hacking Tools Leaked Online (The Hacker News)

Cisco confirms NSA-linked zeroday targeted its firewalls for years (Ars Technica)

Juniper Acknowledges Equation Group Targeted ScreenOS

Why Should These Issues Be Considered Important?

For the affected Cisco devices (a full list is provided here), the most severe of which could allow remote code execution (where an attacker can remotely target your device and have it carry out any action of their choice). The SNMP (defined) vulnerability is the result of a buffer overflow (defined) which can be exploited by an attacker by sending specifically crafted SNMP packets (piece/unit of data being sent via electronic means e.g. within a cable or in the air e.g. WiFi) to an affected device.

Affected Fortinet devices suffer from a similar overflow within their cookie (defined) parser (a tool that analyzes data in a structured manner in order to create meaning from it). As before successful exploitation results in an attacker obtaining remote access to affected devices.

At a later date Juniper acknowledged that their products were also targeted by the group due to the information found within the files that were disclosed. They have since determined that while the code does target their ScreenOS it cannot be used for a remote attack.

How Can I Protect Myself From These Issues?
The relevant Cisco security advisories are available from the following links (further fixes are also expected):

Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability (patch available)

Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability (patch available)

Cisco provides further security recommendations within their dedicated blog post of these vulnerability disclosures that is being updated as new patches are being made available.

A security advisory for the affected Fortinet devices with suggested upgrades detailed within.
As mentioned above Juniper devices are affected but are not remotely exploitable. They continuing to work on a possible means to tell if malicious code has been installed on devices created by them. More information is available within their dedicated forum post.

I hope that the above information is useful to you in defending your corporate networks against these disclosed vulnerabilities.

Thank you.

Juniper Issues Emergency Security Updates For VPN Devices

On the 17th of December Juniper Networks released a security advisory which detailed 2 critical security issues (these have been assigned 2x CVE numbers (defined) within their NetScreen devices which offer VPN (Virtual Private Networks) (defined) access. Juniper have released emergency security updates to address these issues.

Why Should These Issues Be Considered Important?
The first issue assigned CVE-2015-7755 could allow an attacker to remotely access your Juniper VPN device using SSH or telnet. They could do so by accessing your device using either of these protocols. They will then receive a logon prompt however due to this issue they can enter any username and since the password has been publically disclosed they would then obtain access to your device with the highest privileges available. This is an extremely serious backdoor (defined) that an attacker can easily exploit.

The second vulnerability designated CVE-2015-7756 could allow an attacker who can capture your VPN network traffic to decrypt that encrypted traffic and read all of it’s contents. In addition, there is no means of detecting if this second vulnerability has been exploited.

Juniper NetScreen devices using the operating system versions mentioned below have been confirmed to have been affected by these issues:

The first issue mentioned above (the administrative access issue) affects the following versions of ScreenOS (the operating system that powers these Juniper devices):

ScreenOS 6.3.0r17 through 6.3.0r20

The VPN decryption issues affects ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20

Finally, there are theories with compelling evidence of how this backdoor code came to be present within Juniper’s products in the first instance. The definitive answer does not appear to be completely clear at this time. If you wish to read more on this aspect of these security issues, please find below further references:

Juniper Finds Backdoor That Decrypts VPN Traffic by Michael Mimoso (Kaspersky ThreatPost)
Juniper Backdoor Password Goes Public by Michael Mimoso (Kaspersky ThreatPost)
Juniper Backdoor Picture Getting Clearer by Michael Mimoso (Kaspersky ThreatPost)
On the Juniper backdoor by Matthew Green (John Hopkins University)
Who were the attackers and how did they get in? by Jeremy Kirk (IDG News Service)
CVE-2015-7755: Juniper ScreenOS Authentication Backdoor by H. D. Moore (Rapid7)
“Unauthorised code” on Juniper firewalls gives attackers admin access, decrypts VPN traffic by Graham Cluley (writing on behalf of BitDefender)

How Can I Protect Myself From These Issues?
As directed within Juniper’s security advisory if you are using the affected Juniper devices within your corporation or small business, please apply the necessary updates as soon as possible since these issues are very serious. Download links for these updates are provided within the above mentioned security advisory. Juniper also supplies additional best practice within that advisory.

SNORT IDS/IPS (defined) and Sagan (an open source log analysis engine) rules to detect the first issue (administrative access) being exploited are provided in Rapid7’s blog post. That blog post also contains advice if you are having an issue installing the updates to address these issues.

Thank you.

Note: I am currently working on more upcoming content for this blog. Since this will be my final post before the 25th of December I wanted to wish you and yours a safe and very Merry Christmas / Happy Holidays. I will return later this week with more blog posts.

Thanks again.