-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Title: NetScreen Advisory 57739
 
Date: 30 July 2003
 
Impact: Potential Denial of Service of Security Device
 
Affected Products: NetScreen Firewall/VPN products running ScreenOS
4.0.1r1 through 4.0.1r6 and 4.0.3r1 and 4.0.3r2
 
Unaffected Products: NetScreen IDP, NetScreen Firewall/VPN products
running ScreenOS 3 and below, 4.0.0, 4.0.1r7 and higher, 4.0.2, 4.0.3r3
and higher
 
Max Risk: Medium
 
Summary:
 
A malicious user connecting to a NetScreen Security Device with a
certain TCP option set can cause it to reboot, causing a temporary
service outage.
 
Details:
 
Due to a bug in ScreenOS, a non-privileged user who attempts to connect
to a NetScreen Security Device management IP from the range of addresses
permitted by the manager-ip feature with a particular TCP window option
setting can cause the system to crash and reboot.  This issue affects
Telnet and WebUI (HTTP/HTTPS) management, as well as WebAuth
authentication service (HTTP/HTTPS).
 
SSH management connections to the NetScreen device are not susceptible,
nor are the classic policy-driven firewall authentication (ProxyAuth)
connections.  Additionally, traffic passing through the device does not
crash the device, only particular TCP sessions terminating on the device
itself.

Recommended Actions:
 
Restrict administrative access to known administrator hosts and/or
subnets with the 'set admin manager-ip ...' feature.
 
Activate ScreenOS' anti-spoofing feature to prevent spoofed manager IP's
from non-manager subnets.
 
Turn off management on all interfaces not facing the IT management
network (NOC/SOC/etc).
 
Use ProxyAuth instead of WebAuth for policy authentication.
 
Use SSH instead of Telnet to remotely manage your NetScreen firewall.
 
Upgrade to maintenance release r7 or later of ScreenOS 4.0.1, or
maintenance release r3 or later of ScreenOS 4.0.3.
 

Please refer to the following URL for more information:

http://www.netscreen.com/services/security/alerts/advisory-57739.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (Darwin)

iD8DBQE/KXTCUUsgh8bp1hsRAqbQAJ9KuCg2TPXgFUlGKUuLwy17wSYXwgCcClKB
ZcE5Vyb8g12Q7MSBY4Cugo4=
=sSlC
-----END PGP SIGNATURE-----