{"id":305,"date":"2017-08-13T18:23:06","date_gmt":"2017-08-13T22:23:06","guid":{"rendered":"http:\/\/puluka.com\/home\/?p=305"},"modified":"2017-08-13T18:23:06","modified_gmt":"2017-08-13T22:23:06","slug":"critical-screenos-security-flaw","status":"publish","type":"post","link":"http:\/\/puluka.com\/home\/networking\/screenos\/critical-screenos-security-flaw\/","title":{"rendered":"Critical ScreenOS Security Flaw"},"content":{"rendered":"<h2 id=\"post-\">Critical ScreenOS Security Flaw:<br \/>\n6.2.0r15 through 6.2.0r18 and<br \/>\n6.3.0r12 through 6.3.0r20.<\/h2>\n<h1 class=\"p1\">Update 4\/6\/2016: New ScreenOS 6.3r22 release<\/h1>\n<p>Juniper has now completed the ScreenOS VPN updates with the removal of the DUAL_EC_DRBG and the ANSI X9.31 PRNG in ScreenOS 6.3r22<\/p>\n<p><a href=\"http:\/\/forums.juniper.net\/t5\/Security-Incident-Response\/Juniper-Networks-Completes-ScreenOS-Update\/ba-p\/290368\" target=\"_blank\" rel=\"noopener\">http:\/\/forums.juniper.net\/t5\/Security-Incident-Response\/Juniper-Networks-Completes-ScreenOS-Update\/b&#8230;<\/a><\/p>\n<p>Plan on downloading and updating systems accordingly.<\/p>\n<h1>Critical ScreenOS Security Flaw<\/h1>\n<p class=\"p1\">To my friends running ScreenOS from Juniper, please review this critical security notice.<\/p>\n<p class=\"p1\">These issues can affect any product or platform running ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20.\u00a0 The first issue allows unauthorized remote administrative access to the device over SSH or telnet. Exploitation of this vulnerability can lead to complete compromise of the affected system.\u00a0 The second issue may allow a knowledgeable attacker to decrypt encrypted VPN traffic.<\/p>\n<h3 class=\"p1\">UPGRADE AFFECTED SYSTEMS AS SOON AS PRACTICAL<\/h3>\n<p class=\"p1\">Remember to read the new signing key warnings.\u00a0 Your hardware may need the new signing key installed prior to upgrade to boot properly from the new images.<\/p>\n<h3 class=\"p1\">WARNING: ScreenOS SIGNING KEY CHANGED IN AUGUST 2014 &#8211; VERIFY SYSTEMS BEFORE UPGRADE<\/h3>\n<h1 class=\"p1\">Upgrade procedure<\/h1>\n<h2 class=\"p1\">Preparation:<\/h2>\n<p class=\"p1\">1-Download the new signing key from the Juniper support site<\/p>\n<p class=\"p1\"><a href=\"http:\/\/www.juniper.net\/techpubs\/hardware\/netscreen-certifications\/imagekey.zip\">http:\/\/www.juniper.net\/techpubs\/hardware\/netscreen-certifications\/imagekey.zip<\/a><\/p>\n<ul>\n<li>Expand the zip file<\/li>\n<li>Verify the signing key checksum<\/li>\n<\/ul>\n<p class=\"p1\">example on linux<\/p>\n<p class=\"p1\">$ md5sum imagekey.cer<\/p>\n<p class=\"p1\">99def4b80b75ed65aad52a5fc3ed1131\u00a0 imagekey.cer<\/p>\n<p class=\"p1\">Mac OSX use:<\/p>\n<p class=\"p1\">$ md5 imagekey.cer<\/p>\n<p class=\"p1\">MD5 (imagekey.cer) = 99def4b80b75ed65aad52a5fc3ed1131<\/p>\n<p class=\"p1\">Thanks to Ryan in the comments. \u00a0Windows 7 hash check per:<br \/>\n<a href=\"https:\/\/technet.microsoft.com\/en-us\/library\/dn520872.aspx\">https:\/\/technet.microsoft.com\/en-us\/library\/dn520872.aspx<\/a><\/p>\n<p class=\"p1\">Get-FileHash imagekey.cer -Algorithm MD5<\/p>\n<p class=\"p1\">Other Windows you will need to download a check sum utility like this one from MS others are also available<\/p>\n<p class=\"p1\"><a href=\"https:\/\/support.microsoft.com\/en-us\/kb\/889768\">https:\/\/support.microsoft.com\/en-us\/kb\/889768<\/a><\/p>\n<p class=\"p1\">2-Download the ScreenOS Image 6.3R21 from the Support site<\/p>\n<ul>\n<li>Expand the zip file<\/li>\n<li>Verify the ScreenOS file checksum<\/li>\n<\/ul>\n<p class=\"p1\">MD5: 1974c20ed045b4de908a01221db63684<\/p>\n<h2 class=\"p1\">Upgrade procedure:<\/h2>\n<p class=\"p1\">1-Pull a fresh configuraiton backup on all your devices to be sure you have a solid recovery point in case there are issues.<\/p>\n<ul>\n<li>Configuration &gt; Update &gt; Conifg File<\/li>\n<\/ul>\n<p>Choose: Save to file<\/p>\n<p class=\"p1\">2-On the CLI verify which signing key is currently on the device.\u00a0 The new and correct signing key for ScreenOS 6.3R21 begins with\u00a0 308201ad as shown below.<\/p>\n<p class=\"p1\">If the key begins with 308201ac then you MUST UPDATE THE IMAGE KEY BEFORE UPGRADING THE DEVICE.<\/p>\n<p class=\"p1\">ssg5-serial-&gt; exec pki test skey<\/p>\n<p class=\"p1\">exec pki test &lt;skey&gt;.<\/p>\n<p class=\"p1\">Flash base = 0x51000000, Flash end = 0x0, sector size= 0x4000<\/p>\n<p class=\"p1\">KEY1\u00a0 N\/A len =433<\/p>\n<p class=\"p1\">\u00a0308201ad02010002818100fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f80b651 magic1 = f7e9294b magic2=0<\/p>\n<p class=\"p1\">KEY2\u00a0 N\/A len =433<\/p>\n<p class=\"p1\">\u00a0308201ad02010002818100fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f80b651 magic1 = f7e9294b magic2=0<\/p>\n<p class=\"p1\">KEY3\u00a0 N\/A len =433<\/p>\n<p class=\"p1\">\u00a0308201ad02010002818100fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f80b651 magic1 = f7e9294b magic2=0<\/p>\n<p class=\"p1\">2-Upgrade the Image key: \u00a0(if required)<\/p>\n<ul>\n<li>Configuration &gt; Update &gt; ScreenOS\/Keys<\/li>\n<\/ul>\n<p class=\"p1\">Select the Image Signature Key update radio button<\/p>\n<p class=\"p1\">Choose file: the imagekey.cer<\/p>\n<p class=\"p1\">Select Apply button<\/p>\n<p>3-Upgrade ScreenOS:<\/p>\n<ul>\n<li>Configuration &gt; Update &gt; ScreenOS\/Keys<\/li>\n<\/ul>\n<p class=\"p1\">Select the Firmware Update radio button<\/p>\n<p class=\"p1\">Choose file: ssg5ssg20.6.3.0r21.0<\/p>\n<p class=\"p1\">Select Apply<\/p>\n<p class=\"p1\">The file will upload showing progress on the lower left<\/p>\n<p class=\"p1\">When complete it will apply and reboot taking about 5-10 minutes<\/p>\n<p class=\"p1\">3-When the device is available login and confirm the upgrade<\/p>\n<h1 class=\"p1\">Error:\u00a0Bogus image &#8211; not authenticated!!!<\/h1>\n<p>This error will occur if you upgrade to the new ScreenOS image and still have the OLD signing key on your device. \u00a0The boot screen on the console port will show this message:<\/p>\n<p>********Invalid image!!!<br \/>\n********Bogus image &#8211; not authenticated!!!<\/p>\n<p>Fips check failed<br \/>\nDone<\/p>\n<p>To recover from this error and allow the device to boot you need to delete the signing key.<\/p>\n<p>delete crypto auth-key<\/p>\n<p>Then reboot the device and the new ScreenOS should load.<\/p>\n<h1 class=\"p1\">References:<\/h1>\n<h2 class=\"p1\">Security notice<\/h2>\n<p class=\"p1\"><a href=\"http:\/\/kb.juniper.net\/InfoCenter\/index?page=content&amp;id=JSA10713\">http:\/\/kb.juniper.net\/InfoCenter\/index?page=content&amp;id=JSA10713<\/a><\/p>\n<h2 class=\"p1\">Signing Key Articles<\/h2>\n<p class=\"p1\"><a href=\"http:\/\/kb.juniper.net\/InfoCenter\/index?page=content&amp;id=TSB16495\">http:\/\/kb.juniper.net\/InfoCenter\/index?page=content&amp;id=TSB16495<\/a><\/p>\n<p class=\"p1\"><a href=\"http:\/\/kb.juniper.net\/InfoCenter\/index?page=content&amp;id=TSB16496\">http:\/\/kb.juniper.net\/InfoCenter\/index?page=content&amp;id=TSB16496<\/a><\/p>\n<p>Originally Posted December 20, 2015<br \/>\nLast Revised on July 02, 2016<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Critical ScreenOS Security Flaw: 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20. Update 4\/6\/2016: New ScreenOS 6.3r22 release Juniper has now completed the ScreenOS VPN updates with the removal of the DUAL_EC_DRBG and the ANSI X9.31 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-305","post","type-post","status-publish","format-standard","hentry","category-screenos"],"_links":{"self":[{"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/posts\/305","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/comments?post=305"}],"version-history":[{"count":1,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/posts\/305\/revisions"}],"predecessor-version":[{"id":306,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/posts\/305\/revisions\/306"}],"wp:attachment":[{"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/media?parent=305"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/categories?post=305"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/puluka.com\/home\/wp-json\/wp\/v2\/tags?post=305"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}