[30955] in bugtraq
Re: NetScreen ScreenOS 4.0.3r2 DOS
daemon@ATHENA.MIT.EDU (seclist_at_wiresec.net)
Wed Jul 30 13:59:40 2003
From: "seclist_at_wiresec.net" <seclist@wiresec.net>
To: Papa loves Mambo <plm@ioerror.org>
In-Reply-To: <20030729162705.8691.qmail@www.securityfocus.com>
Content-Type: text/plain
Message-Id: <1059576510.31189.21.camel@moneyshot.nationstitle.com>
Mime-Version: 1.0
Date: 30 Jul 2003 09:48:30 -0500
Content-Transfer-Encoding: 7bit
Did you notify Netscreen?
On Tue, 2003-07-29 at 11:27, Papa loves Mambo wrote:
> There is a vulnerability in NetScreen's latest ScreenOS
> that allows a malicious user to create a denial of
> service attack remotely.
>
> This has only been confirmed with the following
> operating systems and NetScreen hardware.
>
> Microsoft Windows 2000 Professional SP1 and SP2
> NetScreen 204 and 208
>
> By modifying the TCP Window size in the registry in W2K
> a user can cause a NetScreen 20x running ScreenOS
> 4.0.3r2 to core dump the ASIC and reboot.
>
> This only affects devices that have management services
> such as Web, Telnet, or SSH enabled on an interface.
>
> When a user tries to connect to one of the management
> ports with the registry settings below the NetScreen
> crashes.
>
> \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
> New DWORD Value
>
> Tcp1323Opts
> HEX
> 3
>
> TcpWindowSize
> Decimal
> 131400
>
> Papa Love Mambo Research Group
> plm at ioerror.org
