+32 (0)2 8010830
Newsflash: Security Vulnerabilities with Juniper ScreenOS System
An unauthorized code in the ScreenOS system is causing illegitimate remote administrative access, and allowing a knowledgeable attacker to monitor and decrypt VPN traffic.
Conclusion - Workaround
The following software releases have been updated to resolve these specific issues: ScreenOS 6.2.0r19, 6.3.0r21, and all subsequent releases.
Additionally, earlier affected releases of ScreenOS 6.3.0 have been respun to resolve these issues. Fixes are included in: 6.3.0r12b, 6.3.0r13b, 6.3.0r14b, 6.3.0r15b, 6.3.0r16b, 6.3.0r17b, 6.3.0r18b, 6.3.0r19b.
The customer is advised to upgrade to a fixed release to resolve these critical vulnerabilities.
An additional recommendation would be to use access lists or firewall filters to restrict the management access from only trusted, internal, administrative networks or hosts. No workaround or detection exists for the VPN decryption vulnerability.
For more information and assistance please contact Infradata by phone +31 (0)71 750 15 25 or by mail firstname.lastname@example.org.