CVE-2016-0777 and CVE-2016-0778 were released by Qualys and cross-announced by OpenSSH on 2016-01-14.
A brief summary of the issue from the announcement follow, full details are available at:
https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt "Since version 5.4 (released on March 8, 2010), the OpenSSH client supports an undocumented feature called roaming: if the connection to an SSH server breaks unexpectedly, and if the server supports roaming as well, the client is able to reconnect to the server and resume the suspended SSH session.
Although roaming is not supported by the OpenSSH server, it is enabled by default in the OpenSSH client, and contains two vulnerabilities that can be exploited by a malicious SSH server (or a trusted but compromised server): an information leak (memory disclosure), and a buffer overflow (heap-based)."
The attack vector leading to potential compromise in these scenarios relates to a session initated from a Junos OS device using the SSH client to an external SSH server.
No ScreenOS products or platforms are affected by these issues.
Juniper continues to investigate other products and services. As investigations are completed this JSA will be updated.
These issues have been assigned CVE-2016-0777 and CVE-2016-0778.
The following software releases have been updated to resolve these specific issues with the SSH client: Junos OS 12.1X46-D45, 12.1X46-D51, 12.1X47-D35, 12.3R12, 12.3X48-D30, 13.3R9, 14.1R7, 14.2R6, 15.1F5, 15.1R3, 15.1X49-D40 and all subsequent releases.
These issues are being tracked and are visible on the Customer Support website under the following PR: 1154016
KB16765 - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies.
It is good security practice to connect only to known, trusted, SSH servers from critical infrastructure networking equipment. Use outgoing access lists or egress firewall filters to limit access from sensitive network devices to only trusted, administrative networks or hosts.
Modification History: 2016-04-13: Initial publication
2016-05-04: Added 12.1X46-D51 to list of fixed releases.
Note: 12.1X46-D50 does not include this fix.
Information for how Juniper Networks uses CVSS can be found at KB 16446 "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."