ID

VAR-200508-0142

CVE

CVE-2005-2640

TITLE

Juniper Netscreen VPN Username Enumeration Vulnerability

DESCRIPTION

Behavioral discrepancy information leak in Juniper Netscreen VPN running ScreenOS 5.2.0 and earlier, when using IKE with pre-shared key authentication, allows remote attackers to enumerate valid usernames via an IKE Aggressive Mode packet, which generates a response if the username is valid but does not respond when the username is invalid. NetScreen ScreenOS of IKE In the protocol implementation, IKE User name included in aggressive mode messages (IKE ID) Is valid VPN There are vulnerabilities that respond differently depending on whether you are a user.An effective VPN You may get your username and password hash. This allows for attackers to obtain a list of valid VPN users. With a valid username, an attacker can obtain hashed credentials against which a brute force attack may be performed. A successful crack would mean that the attacker has complete access to the network. Netscreen is one of Juniper's leading line of networking and security products. Juniper Netscreen's integrated firewall/VPN product has a VPN user name enumeration vulnerability when performing VPN security tests for customers. Once a username is discovered, an attacker can use that username to get a hash from Netscreen and then crack the associated password offline. ---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Juniper Netscreen IPSec VPN Username Enumeration Weakness SECUNIA ADVISORY ID: SA16474 VERIFY ADVISORY: http://secunia.com/advisories/16474/ CRITICAL: Not critical IMPACT: Exposure of system information WHERE: >From remote OPERATING SYSTEM: NetScreen ScreenOS 5.x http://secunia.com/product/2569/ NetScreen ScreenOS 4.x http://secunia.com/product/695/ NetScreen ScreenOS 3.x http://secunia.com/product/798/ NetScreen ScreenOS 2.x http://secunia.com/product/1395/ DESCRIPTION: NTA Monitor has reported a weakness in Juniper Netscreen VPN, which can be exploited by malicious people to gain knowledge of certain information. The weakness is caused due to the device returning different responses depending on whether or not a valid username is supplied. This can be exploited to enumerate valid usernames, which can be used to obtain password hashes. The weakness has been reported in ScreenOS software versions up to 5.2.0. SOLUTION: Use certificate authentication instead of pre-shared key authentication. PROVIDED AND/OR DISCOVERED BY: NTA Monitor ORIGINAL ADVISORY: NTA Monitor: http://www.nta-monitor.com/news/vpn-flaws/juniper/netscreen/index.htm ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

Design Error

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Roy Hills Roy.Hills@nta-monitor.com

SOURCES

LAST UPDATE DATE

2024-08-14T13:51:02.997000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE