Notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS# Juniper CVE-2015-7755 & CVE-2015-7756
This repository contains notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS.
For more information about these issues, please see the URLs below:
* https://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554
* https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=SIRT_1&actp=LIST&smlogin=true
## Findings
* CVE-2015-7755: This password has been identified as ``<<< %s(un='%s') = %u``. Please see [this blog post](https://community.rapid7.com/community/infosec/blog/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor) for more information.
* CVE-2015-7765: The Dual_EC_DRBG 'Q' parameter was replaced with ``9585320EEAF81044F20D55030A035B11BECE81C785E6C933E4A8A131F6578107`` and the secondary ANSI X.9.31 PRNG was broken, allowing raw Dual_EC output to be exposed to the network. Please see [this blog post](https://rpw.sh/blog/2015/12/21/the-backdoored-backdoor/) for more information.
## 6.2.0 Firmware
* ssg500.6.2.0r14.0.bin: This is the last stable 6.2.0 release before the backdoors were introduced.
* ssg500.6.2.0r15.0.bin: This is the first stable 6.2.0 release containing the backdoor. Not affected by CVE-2015-7755.
* ssg500.6.2.0r16.0.bin: Not affected by CVE-2015-7755.
* ssg5ssg20.6.2.0r18.0.bin: Not affected by CVE-2015-7755.
## 6.3.0 Firmware
* ssg500.6.3.0r12.0.bin: This is the first stable 6.3.0 release with the backdoor introduced. Not affected by CVE-2015-7755.
* ssg500.6.3.0r12b.0.bin: This is the rebuilt 6.3.0r12 release with the backdoor removed.
* ssg5ssg20.6.3.0r14.0.bin: Not affected by CVE-2015-7755.
* ssg5ssg20.6.3.0r17.0.bin: Confirmed CVE-2015-7755.
* ssg5ssg20.6.3.0r18.0.bin: Confirmed CVE-2015-7755.
* ssg5ssg20.6.3.0r19.0.bin: Confirmed CVE-2015-7755.
* ssg5ssg20.6.3.0r19b.0.bin: Rebuilt version with the backdoors removed.
## Unpacking
The firmware files in this repository were extracted from the Juniper software distributon using ``binwalk -e``. The resulting files contains the raw x86 firmware, which can loaded into tools like IDA Pro. Data references in IDA Pro are incorrect due to some of section padding or alignment that occurs when the firmware is loaded into memory.
[4.0K] /data/pocs/f74c6790aaa35f76eef2a3475cc2afef4787d585
├── [4.0K] decompiled
│ ├── [ 231] README.md
│ ├── [ 49M] ssg500.6.3.0r12.0.c
│ ├── [ 49M] ssg500.6.3.0r12b.0.c
│ ├── [ 64M] ssg5ssg20.6.3.0r19.0.c
│ └── [ 64M] ssg5ssg20.6.3.0r19b.0.c
├── [4.0K] diffs
│ ├── [ 56K] ssg500.6.2.0r14.0-15.0.strings.diff
│ └── [6.6K] ssg500.6.3.0r12.0-t12b.0.strings.diff
├── [4.0K] firmware
│ ├── [ 26M] ssg500.6.2.0r14.0.bin
│ ├── [ 26M] ssg500.6.2.0r15.0.bin
│ ├── [ 26M] ssg500.6.2.0r16.0.bin
│ ├── [ 28M] ssg500.6.3.0r12.0.bin
│ ├── [ 28M] ssg500.6.3.0r12b.0.bin
│ ├── [ 28M] ssg500.6.3.0r19.0.bin
│ ├── [ 28M] ssg500.6.3.0r19b.0.bin
│ ├── [ 32M] ssg5ssg20.6.2.0r18.0.bin
│ ├── [ 32M] ssg5ssg20.6.3.0r12.0.bin
│ ├── [ 32M] ssg5ssg20.6.3.0r12b.0.bin
│ ├── [ 32M] ssg5ssg20.6.3.0r14.0.bin
│ ├── [ 32M] ssg5ssg20.6.3.0r17.0.bin
│ ├── [ 13M] ssg5ssg20.6.3.0r17.0.zip
│ ├── [ 13M] ssg5ssg20.6.3.0r17a.0.zip
│ ├── [ 32M] ssg5ssg20.6.3.0r19.0.bin
│ └── [ 32M] ssg5ssg20.6.3.0r19b.0.bin
└── [2.3K] README.md
3 directories, 24 files