NetScreen Secure Command Shell (SCS) denial-of-service vulnerability

2002-11-19T00:00:00
ID VU:930161
Type cert
Reporter CERT
Modified 2002-12-10T21:16:00

Description

Overview

The Secure Command Shell service on NetScreen firewall products contains a remotely exploitable denial-of-service vulnerability.

Description

Firewall products from NetScreen Technologies, Inc. include a Secure Shell version 1 (SSHv1) implementation called Secure Command Shell (SCS). The SCS service contains a remotely exploitable denial-of-service vulnerability which can cause affected units to crash. According to the original reporter, programs which attempt to exploit VU#945216 trigger the vulnerability and cause the unit to crash. NetScreen has confirmed this, but has stated that this vulnerability is not the same as VU#945216.


Impact

A remote attacker can cause the affected unit to crash. The original reporter indicates that the system may subsequently require a hard reboot.


Solution

NetScreen has issued a patch for this vulnerability. Information about it can be found at

_ _<http://www.netscreen.com/support/alerts/11_06_02.html>


Workarounds

If patches cannot be applied, NetScreen recommends disabling the SCS service on affected systems. Note that according to NetScreen the SCS service is not enabled by default.
If the service cannot be disabled, limit access to the SSH service to only trusted hosts on the internal network.


Vendor Information

930161

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Vendor has issued information

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

NetScreen __ Affected

Notified: November 07, 2002 Updated: November 14, 2002

Status

Affected

Vendor Statement

NetScreen has posted a security alert notice in response to this. You can find our response by going to

<http://www.netscreen.com/support/alerts/11_06_02.html>

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | | N/A

References

  • <http://www.netscreen.com/support/alerts/11_06_02.html>
  • <http://online.securityfocus.com/archive/1/298274>
  • <http://online.securityfocus.com/archive/1/298288>
  • <http://online.securityfocus.com/archive/1/298289>

Acknowledgements

Thanks to Erik Parker of DigitalDefense for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

CVE IDs: | None
---|---
Severity Metric: | 5.40
Date Public: | 2002-11-01
Date First Published: | 2002-11-19
Date Last Updated: | 2002-12-10 21:16 UTC
Document Revision: | 14