Pages

Thursday, January 7, 2010

Juniper JUNOS Remote Kernel Crash Flaw!

"Juniper Networks is warning customers of a critical flaw in its gateway routers that allows attackers to crash the devices by sending them small amounts of easily-spoofed traffic." - The Register news.

The JunOS kernel will crash (i.e. core) when a specifically crafted TCP option is received on a listening TCP port. The packet cannot be filtered with Junos's firewall filter. A router receiving this specific TCP packet will crash and reboot.

Affected Devices:
JunOS 3.x - 10.x (versions released later then 1/28/2009)
Software releases built on or after January 28, 2009 have already fixed the issue.
Solution:
Upgrade the OS. There are no totally effective workarounds.

Funny:
"A Juniper spokeswoman said the bulletin was one of seven security advisories the company issued under a policy designed to prevent members of the public at large from getting details of the vulnerabilities."
"Because of Juniper's 'Entitled Disclosure Policy,' only our customers and partners are allowed access to the details of the Security Advisory," the spokeswoman wrote.
Ooohhh... How about this: "when a specifically crafted TCP option is received on a listening TCP port"?
It's more than enough! We have 256 guesses ;)

Simple Proof-of-Concept demo:

hod# ping 169.254.1.1
PING 169.254.1.1 (169.254.1.1): 56 data bytes
64 bytes from 169.254.1.1: icmp_seq=0 ttl=254 time=4.623 ms
64 bytes from 169.254.1.1: icmp_seq=1 ttl=254 time=4.531 ms
64 bytes from 169.254.1.1: icmp_seq=2 ttl=254 time=4.315 ms
^C<...>

hod# ./hod-junos-test 169.254.1.1 22
[*] Target IP: 169.254.1.1, Port: 22
[+] Sending TCP-packets with various crafted TCP options
[+] TCP options bruteforce progress:
[..........................................................
...........................................................
...........................................................
.......................................................]
[+] OK

hod# ping 169.254.1.1
PING 169.254.1.1 (169.254.1.1): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
^C

256 packets and JunOS router is dead, and after analyze sniffing traffic we are know true "evil" TCP packet!

The JUNOS firewall filter (ACL) is unable to filter a TCP packet with this issue!
Successful exploitation requires knowledge of a listening remote TCP port (opened or firewall filtered, it doesn't matter at all).
For example, attackers can send (blind) a many numbers of crafted packets to "well known" TCP ports (22/SSH, 179/BGP and other).
And That's enough.

63 comments:

  1. Are you just looping through the first 8 bits of the TCP options header? Looking at the ol' TCP header diagram here it looks like TCP options + padding has 32 bits to muck with.

    ReplyDelete
  2. Thx Ryan for comment.

    Of course, tcp options have a variable length.
    In the first testcase, i fuzzing only the option-kind octet:
    option-kind octet - fuzzing
    other octets - constants
    And of course, full fuzzing - is much more than 8 bits, but not long too.

    ReplyDelete
  3. Thanks!

    It was late when I tried this, but I see now that the options are variable length. I looped through all the values in the option-kind octet (assuming only one option here), with a value octet of x00, then I tried just plain leaving the value off. I could do some captures here, but am using Scapy and I betcha it is properly padding out the option field... this requires an improperly padded field right?

    ReplyDelete
  4. Also see this blog + video:
    http://www.toonk.nl/blog/?p=522
    seems that firewall filters do help to a certain extend.

    ReplyDelete
  5. Anabolic steroids” is the familiar name for synthetic variants of the male sex hormone testosterone. Read about the different types of anabolic steroids. http://www.mensreviewmonster.com/mens-fitness/muscle-builder/crazy-bulk-detailed-review-online/

    ReplyDelete
  6. Capsiplex Sport safely increases your metabolism and boosts your energy levels while you exercise to boost your weight loss efforts! Find Capsiplex review at http://www.dietreviewmonster.com/

    ReplyDelete
  7. crazy bulk is one of the best selling legal steroids which help in gaining strength, muscle,visit here : http://www.buycrazybulks.com/

    ReplyDelete
  8. PhenQ Reviews - Most Powerful Weight Loss Pills. PhenQ is the newest weight loss pill that has been proven by legitimate and smart science. http://phenq-reviews.com/

    ReplyDelete
  9. The best Weight Loss Supplements in Best Sellers. Find the top products most popular items in weight loss opinion http://www.weightlossopinion.com/

    ReplyDelete
  10. I really like your idea of http://blogweightlossdietposts.tumblr.com/
    Thanks for the information http://awesomefitnessads.blogspot.com/
    Thanks for the best blog. http://weightloss-diettipz.weebly.com/
    Really impressive post.https://weightlossdiet2015.wordpress.com/
    Useful information.I am actual blessed to read this article.http://5tipz.livejournal.com/
    Here's the right information for the best results. http://weightlossdiet2016.jimdo.com/

    ReplyDelete
  11. Garcinina Cambogia extract was recently featured on Dr. Oz where he proclaimed it as the "Holy Grail of Weight Loss" supplements. Learn how Dr Oz Garcinia Extracts Works to Lose Weight, Burn fat and suppress appetite.

    ReplyDelete
  12. noocube Nootropics also called smart drugs, memory enhancers, neuro enhancers, cognitive enhancers, and intelligence enhancers. Find detailed Noocube review, effects & facts. http://www.noocube-nootropics.com/

    ReplyDelete
  13. Extreme Nutritions Selling Bodybuilding,Weightloss,Women's health and Sexual Products for All and Get the Best Prices on Extreme Nutritions Supplements Legal Steroids

    ReplyDelete
  14. Best packers and movers in Pune, household shifting service in Pune, home relocation in Pune, car carriers service in Pune, car transport in Pune. packers and movers Pune

    ReplyDelete
  15. PhenQ Is A Unique New Slimming Product Designed To Give You Better Results http://www.phenq-pills.com/ ... phenq review

    ReplyDelete
  16. Be sure to get the best deal on Phen375. Beware of cheap imitations. Check out our Phen375 review and find out more!

    ReplyDelete
  17. اتصلوا بنا تجدونا اينما كنتم وفى كل وقت وكل مكان
    نتعامل معكم بافضل جوده واحسن اداء واقل الاسعار
    مع شركة اركان المملكه انتو تتعاملون مع افضل شركة بالمملكه ككل
    لاننا شركة زات باع كبير فى عالم التنظيف على مر السنين ونعمل باقصى جهد من اجل راحتكم اولااا
    :::::::::::::::::::::::::::::::::::::
    شركة كشف تسربات المياه بجازان




    شركة كشف تسربات المياه بخميس مشيط



    شركة كشف تسربات المياه بابها



    شركة كشف تسربات المياه بالدمام



    شركة كشف تسربات المياه بالرياض

    شركة نقل اثاث بجازان



    تسليك مجارى بالدمام




    شركة تسليك مجارى بجازان




    شركة تسليك مجارى بابها

    شركة نقل عفش بالرياض


    شركة نقل عفش بخميس مشيط

    ReplyDelete
  18. Welcome to Buy Health Mart, an online natural health Products store serving health-conscious consumers across the US and Worldwide! http://www.buyhealthmart.com/ Buy Health Mart

    ReplyDelete
  19. I Have Been wondering about this issue, so thanks for posting.
    vigrx plus

    ReplyDelete
  20. MaleExtra is the popular sexual health supplement designed for better sex. Find out how Male Extra pills work, their ingredients, where to buy and more.

    ReplyDelete
  21. PhenQ is the newest weight loss pill that has been proven by legitimate and smart science. Read all about PhenQ Review or Side Effects before You Buy It.

    ReplyDelete
  22. Muscletronic is a supplement that is able to build muscle, improve cognitive function, increase motivation, drive and focus.

    ReplyDelete
  23. Thanks for this help. Hope so that this will help me in my next project. I like play game piano tiles | Piano Tiles | piano tiles 2 game | piano tiles | piano tiles 2 | Dream League Soccer | Score Hero | Score Hero game | Score Hero | Score Hero | Score Hero game | piano tiles 2 | piano tiles 2 game | so much. How about you? B612 | camera b612 | descargar b612 | b612 | b612 | descargar b612 gratis | camera b612 | Dream League Soccer | Stick RPG 2 | Stick RPG | StickRPG2. B612 lets you make collages with your pictures. You can make them with just a regular selfie or a composition of up to nine photographs, and even vertical compositions of two or three pictures.

    ReplyDelete
  24. You’re alone in a zombie infested desert. Your only means of defense is your truck. Kill zombies to earn money, and then use the money to buy upgrades for your truck to help you to go through all the obstacles and defend yourself. Earn bonus cash by coming up with creative and impressive ways to kill the zombies, as well as breaking down other obstacles and barriers in your path.
    Use the arrow keys for navigation
    earn to die game123

    earn to die5

    earn to die game vui

    earn to die23

    earn to die game play

    This free game will warehouse is aggregated from multiple sources. Gaming system themed categories: tactical, racing, sports, action, earn to die, age of war, tank trouble
    freetowerdefensegames

    age of war

    earn to die
    tank trouble
    earn to die 2
    earn to die
    earn to die 4

    earn to die 5

    ReplyDelete
  25. If you are looking for some reliable way to shed the excess amount of unwanted fat from your body then the best option is Forskolin Fuel http://www.wheretobuyforskolinfuel.com/
    Forskolin Fuel

    ReplyDelete
  26. This is a great article, that I really enjoyed reading. Thanks for sharing.

    - FNAF Sister Location
    - FNAF 5
    - Five Nights At Freddy's

    ReplyDelete
  27. The war between humans, orcs and elves continues. Lead your race through a series of epic battles, using your crossbow to fend off foes and sending out units to destroy castles. Researching and upgrading wisely will be crucial to your success!
    age of war 3 | age of war 2 | unfair mario 2 | tank trouble 3 | tank trouble
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    cubefield | tank trouble | happy wheels | slitherio | gold mine

    ReplyDelete
  28. Thanks for sharing this quality information with us. I really enjoyed reading.
    slither io | wings io | science kombat | tank trouble 4

    ReplyDelete
  29. Score Hero é um dos excelentse jogos de futebol para telemóveis e dispositivos que usam Android de 2 ou superior. Photo Grid é um aplicativo de edição de foto, fazer colagem com muitos quadros atraentes.

    ReplyDelete
  30. Forskolin fuel is an advanced natural weight loss formula that has been recently launched in the market. The product has been receiving excellent response from the buyers and is winning hearts of people all over the globe. For more Information Visit: http://www.forskolinfuel-reviews.com/
    Forskolin fuel

    ReplyDelete
  31. Welcomes to google terminal from Austin Texas! google snake
    Amazing insight you have on this, Happy wheels it's nice to find a website that details so much information about different artists... Age of war 2 This article always blew me... Earn to die For how many times I have read this.
    slither io Hi! I’ve been reading your blog for a while slitherio it's nice to find a website that details so much big farm

    ReplyDelete