Skip to content
master
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 
 
 

README.md

Juniper CVE-2015-7755 & CVE-2015-7756

This repository contains notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS.

For more information about these issues, please see the URLs below:

Findings

  • CVE-2015-7755: This password has been identified as <<< %s(un='%s') = %u. Please see this blog post for more information.
  • CVE-2015-7765: The Dual_EC_DRBG 'Q' parameter was replaced with 9585320EEAF81044F20D55030A035B11BECE81C785E6C933E4A8A131F6578107 and the secondary ANSI X.9.31 PRNG was broken, allowing raw Dual_EC output to be exposed to the network. Please see this blog post for more information.

6.2.0 Firmware

  • ssg500.6.2.0r14.0.bin: This is the last stable 6.2.0 release before the backdoors were introduced.
  • ssg500.6.2.0r15.0.bin: This is the first stable 6.2.0 release containing the backdoor. Not affected by CVE-2015-7755.
  • ssg500.6.2.0r16.0.bin: Not affected by CVE-2015-7755.
  • ssg5ssg20.6.2.0r18.0.bin: Not affected by CVE-2015-7755.

6.3.0 Firmware

  • ssg500.6.3.0r12.0.bin: This is the first stable 6.3.0 release with the backdoor introduced. Not affected by CVE-2015-7755.
  • ssg500.6.3.0r12b.0.bin: This is the rebuilt 6.3.0r12 release with the backdoor removed.
  • ssg5ssg20.6.3.0r14.0.bin: Not affected by CVE-2015-7755.
  • ssg5ssg20.6.3.0r17.0.bin: Confirmed CVE-2015-7755.
  • ssg5ssg20.6.3.0r18.0.bin: Confirmed CVE-2015-7755.
  • ssg5ssg20.6.3.0r19.0.bin: Confirmed CVE-2015-7755.
  • ssg5ssg20.6.3.0r19b.0.bin: Rebuilt version with the backdoors removed.

Unpacking

The firmware files in this repository were extracted from the Juniper software distributon using binwalk -e. The resulting files contains the raw x86 firmware, which can loaded into tools like IDA Pro. Data references in IDA Pro are incorrect due to some of section padding or alignment that occurs when the firmware is loaded into memory.

About

Notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS

Resources

Releases

No releases published

Packages

No packages published

Languages

You can’t perform that action at this time.