Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10679) (FREAK)
medium Nessus Plugin ID 82912
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote device is missing a vendor-supplied security patch.Description
According to its self-reported version number, the remote Juniper Junos device is affected by the following vulnerabilities related to OpenSSL :- A NULL pointer dereference flaw exists when the SSLv3 option isn't enabled and an SSLv3 ClientHello is received. This allows a remote attacker, using an unexpected handshake, to crash the daemon, resulting in a denial of service. (CVE-2014-3569)
- The BIGNUM squaring (BN_sqr) implementation does not properly calculate the square of a BIGNUM value. This allows remote attackers to defeat cryptographic protection mechanisms. (CVE-2014-3570)
- A flaw exists with ECDH handshakes when using an ECDSA certificate without a ServerKeyExchange message. This allows a remote attacker to trigger a loss of forward secrecy from the ciphersuite. (CVE-2014-3572)
- A flaw exists when accepting non-DER variations of certificate signature algorithms and signature encodings due to a lack of enforcement of matches between signed and unsigned portions. A remote attacker, by including crafted data within a certificate's unsigned portion, can bypass fingerprint-based certificate-blacklist protection mechanisms. (CVE-2014-8275)
- A security feature bypass vulnerability, known as FREAK (Factoring attack on RSA-EXPORT Keys), exists due to the support of weak EXPORT_RSA cipher suites with keys less than or equal to 512 bits. A man-in-the-middle attacker may be able to downgrade the SSL/TLS connection to use EXPORT_RSA cipher suites which can be factored in a short amount of time, allowing the attacker to intercept and decrypt the traffic. (CVE-2015-0204)
- A flaw exists when accepting DH certificates for client authentication without the CertificateVerify message.
This allows a remote attacker to authenticate to the service without a private key. (CVE-2015-0205)
Note that these issues only affects devices with J-Web or the SSL service for JUNOScript enabled.
Solution
Apply the relevant Junos software release or workaround referenced in Juniper advisory JSA10679.See Also
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679
Plugin Details
Severity: Medium
ID: 82912
File Name: juniper_jsa10679.nasl
Version: 1.12
Type: combined
Family: Junos Local Security Checks
Published: 4/21/2015
Updated: 7/12/2018
Dependencies: junos_version.nasl
Risk Information
VPR
Risk Factor: Medium
Score: 4.5
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/o:juniper:junos, cpe:/a:openssl:openssl
Required KB Items: Host/Juniper/JUNOS/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 4/8/2015
Vulnerability Publication Date: 10/16/2014
Reference Information
CVE: CVE-2014-3569, CVE-2014-3570, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205
JSA: JSA10679
CERT: 243585