makash/juniper-cve-2015-7755

Notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS

Juniper CVE-2015-7755 & CVE-2015-7756

This repository contains notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS.

For more information about these issues, please see the URLs below:

• https://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=SIRT_1&actp=LIST&smlogin=true

Findings

• CVE-2015-7755: This password has been identified as <<< %s(un='%s') = %u. Please see this blog post for more information.
• CVE-2015-7765: The Dual_EC_DRBG 'Q' parameter was replaced with 9585320EEAF81044F20D55030A035B11BECE81C785E6C933E4A8A131F6578107 and the secondary ANSI X.9.31 PRNG was broken, allowing raw Dual_EC output to be exposed to the network. Please see this blog post for more information.

6.2.0 Firmware

• ssg500.6.2.0r14.0.bin: This is the last stable 6.2.0 release before the backdoors were introduced.
• ssg500.6.2.0r15.0.bin: This is the first stable 6.2.0 release containing the backdoor. Not affected by CVE-2015-7755.
• ssg500.6.2.0r16.0.bin: Not affected by CVE-2015-7755.
• ssg5ssg20.6.2.0r18.0.bin: Not affected by CVE-2015-7755.

6.3.0 Firmware

• ssg500.6.3.0r12.0.bin: This is the first stable 6.3.0 release with the backdoor introduced. Not affected by CVE-2015-7755.
• ssg500.6.3.0r12b.0.bin: This is the rebuilt 6.3.0r12 release with the backdoor removed.
• ssg5ssg20.6.3.0r14.0.bin: Not affected by CVE-2015-7755.
• ssg5ssg20.6.3.0r17.0.bin: Confirmed CVE-2015-7755.
• ssg5ssg20.6.3.0r18.0.bin: Confirmed CVE-2015-7755.
• ssg5ssg20.6.3.0r19.0.bin: Confirmed CVE-2015-7755.
• ssg5ssg20.6.3.0r19b.0.bin: Rebuilt version with the backdoors removed.

Unpacking

The firmware files in this repository were extracted from the Juniper software distributon using binwalk -e. The resulting files contains the raw x86 firmware, which can loaded into tools like IDA Pro. Data references in IDA Pro are incorrect due to some of section padding or alignment that occurs when the firmware is loaded into memory.

Unpacking the SSG5/SSG20 firmware takes a little more work.