Products & Services
Support Training How to Buy Search

Knowledge Search


 ×
 

2016-04 Security Bulletin: Junos: OpenSSH Client Information Leak and Buffer Overflow in roaming support (CVE-2016-0777, CVE-2016-0778)

 [JSA10734] Show Article Properties

Product Affected:
These issues can affect any product or platform running Junos OS.
Problem:
CVE-2016-0777 and CVE-2016-0778 were released by Qualys and cross-announced by OpenSSH on 2016-01-14.

A brief summary of the issue from the announcement follow, full details are available at:
https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt

"Since version 5.4 (released on March 8, 2010), the OpenSSH client supports an undocumented feature called roaming: if the connection to an SSH server breaks unexpectedly, and if the server supports roaming as well, the client is able to reconnect to the server and resume the suspended SSH session.

Although roaming is not supported by the OpenSSH server, it is enabled by default in the OpenSSH client, and contains two vulnerabilities that can be exploited by a malicious SSH server (or a trusted but compromised server): an information leak (memory disclosure), and a buffer overflow (heap-based)."
The attack vector leading to potential compromise in these scenarios relates to a session initated from a Junos OS device using the SSH client to an external SSH server.

No ScreenOS products or platforms are affected by these issues.

Juniper continues to investigate other products and services.  As investigations are completed this JSA will be updated.

These issues have been assigned CVE-2016-0777 and CVE-2016-0778.





Solution:
The following software releases have been updated to resolve these specific issues with the SSH client: Junos OS 12.1X46-D45, 12.1X46-D51, 12.1X47-D35, 12.3R12, 12.3X48-D30, 13.3R9, 14.1R7, 14.2R6, 15.1F5, 15.1R3, 15.1X49-D40 and all subsequent releases.

These issues are being tracked and are visible on the Customer Support website under the following PR: 1154016

KB16765 - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies.
Workaround:
It is good security practice to connect only to known, trusted, SSH servers from critical infrastructure networking equipment. Use outgoing access lists or egress firewall filters to limit access from sensitive network devices to only trusted, administrative networks or hosts.
Implementation:
How to obtain fixed software:
Security vulnerabilities in Junos are fixed in the next available Maintenance Release of each supported Junos version. In some cases, a Maintenance Release is not planned to be available in an appropriate time-frame. For these cases, Service Releases are made available in order to be more timely. Security Advisory and Security Notices will indicate which Maintenance and Service Releases contain fixes for the issues described. Upon request to JTAC, customers will be provided download instructions for a Service Release. Although Juniper does not provide formal Release Note documentation for a Service Release, a list of "PRs fixed" can be provided on request.

Modification History:
Modification History:

2016-04-13: Initial publication
2016-05-04: Added 12.1X46-D51 to list of fixed releases.
            Note: 12.1X46-D50 does not include this fix.

Related Links:
CVSS Score:
5.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
Risk Level:
Medium
Risk Assessment:
Information for how Juniper Networks uses CVSS can be found at KB 16446 "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."
Acknowledgements: