Support Support Downloads Knowledge Base Juniper Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

2016-04 Security Bulletin: Junos: OpenSSH Client Information Leak and Buffer Overflow in roaming support (CVE-2016-0777, CVE-2016-0778)



Article ID: JSA10734 SECURITY_ADVISORIES Last Updated: 04 May 2016Version: 2.0
Product Affected:
These issues can affect any product or platform running Junos OS.
CVE-2016-0777 and CVE-2016-0778 were released by Qualys and cross-announced by OpenSSH on 2016-01-14.

A brief summary of the issue from the announcement follow, full details are available at:

"Since version 5.4 (released on March 8, 2010), the OpenSSH client supports an undocumented feature called roaming: if the connection to an SSH server breaks unexpectedly, and if the server supports roaming as well, the client is able to reconnect to the server and resume the suspended SSH session.

Although roaming is not supported by the OpenSSH server, it is enabled by default in the OpenSSH client, and contains two vulnerabilities that can be exploited by a malicious SSH server (or a trusted but compromised server): an information leak (memory disclosure), and a buffer overflow (heap-based)."

The attack vector leading to potential compromise in these scenarios relates to a session initated from a Junos OS device using the SSH client to an external SSH server.

No ScreenOS products or platforms are affected by these issues.

Juniper continues to investigate other products and services.  As investigations are completed this JSA will be updated.

These issues have been assigned CVE-2016-0777 and CVE-2016-0778.

The following software releases have been updated to resolve these specific issues with the SSH client: Junos OS 12.1X46-D45, 12.1X46-D51, 12.1X47-D35, 12.3R12, 12.3X48-D30, 13.3R9, 14.1R7, 14.2R6, 15.1F5, 15.1R3, 15.1X49-D40 and all subsequent releases.

These issues are being tracked and are visible on the Customer Support website under the following PR: 1154016

KB16765 - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies.
It is good security practice to connect only to known, trusted, SSH servers from critical infrastructure networking equipment. Use outgoing access lists or egress firewall filters to limit access from sensitive network devices to only trusted, administrative networks or hosts.
How to obtain fixed software:
Security vulnerabilities in Junos are fixed in the next available Maintenance Release of each supported Junos version. In some cases, a Maintenance Release is not planned to be available in an appropriate time-frame. For these cases, Service Releases are made available in order to be more timely. Security Advisory and Security Notices will indicate which Maintenance and Service Releases contain fixes for the issues described. Upon request to JTAC, customers will be provided download instructions for a Service Release. Although Juniper does not provide formal Release Note documentation for a Service Release, a list of "PRs fixed" can be provided on request.

Modification History:
Modification History:

2016-04-13: Initial publication
2016-05-04: Added 12.1X46-D51 to list of fixed releases.
            Note: 12.1X46-D50 does not include this fix.

CVSS Score:
5.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
Severity Level:
Severity Assessment:
Information for how Juniper Networks uses CVSS can be found at KB 16446 "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Related Links

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search