Zero-day vulnerability in Juniper ScreenOS
Authentication bypass
CVE-2015-7755
Revealed during source code review by the vendor.
Vulnerability details
Advisory: SB2015121701 - Two backdoors in Juniper ScreenOS
Vulnerable component: Juniper ScreenOS
CVE-ID: CVE-2015-7755
CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CWE-ID: CWE-287 - Improper Authentication
Description:
The vulnerability allows a remote attacker to bypass authentication on the target system.
The weakness exists due to presence of backdoor in Juniper ScreenOS code. A remote attacker can enter a password "<<< %s(un='%s') = %u" during a SSH or TELNET session and obtain administrative access to the device.
Successful exploitation of the vulnerability results in unauthorized access to the vulnerable system.
Note: the vulnerability was being actively exploited.
External links:
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=SIRT_1&actp=LIST
https://blog.cryptographyengineering.com/2015/12/22/on-juniper-backdoor/
http://securityaffairs.co/wordpress/42983/hacking/juniper-backdoor-attacks-honeypot.html
https://adamcaudill.com/2015/12/17/much-ado-about-juniper/
http://www.dmnews.com/news-bytes/juniper-warns-of-two-attacks-of-unauthorised-code-on-its-routers/ar...
http://resources.infosecinstitute.com/infosec-year-end-highlights/#gref
https://www.wired.com/2015/12/researchers-solve-the-juniper-mystery-and-they-say-its-partially-the-n...
https://thehackernews2.blogspot.com/2016/12/backdoor-found-in-sonys-ip-security.html
http://blogs.splunk.com/2016/01/05/discover-and-monitor-juniper-vulnerability-cve-2015-7755-exploits...
http://www.securityweek.com/juniper-firewall-backdoor-password-found-6-hours
http://www.theregister.co.uk/2015/12/20/juniper_details_two_attacks_from_unauthorised_code/