Information Security News
GDPR Passes the Security Test
Last week we reported that the EU Parliament and Council had agreed on a text for the long-awaited General Data Protection Regulation (GDPR). The agreement for the GDPR could lead to fines of up to 4% of annual turnover for firms which break the rules; ...
Almost completely lost in the hype of theJuniper unauthorized codebackdoor vulnerability (CVE-2015-7755) is the other vulnerability that was fixed as part of the same patch(CVE-2015-7756). CVE-2015-7756is titled ScreenOS VPN decryption vulnerability and from the Juniper bulletin this vulnerability may">allow a knowledgeable attacker who can monitor VPN traffic to decrypt that traffic. In short this vulnerability is a cryptographic flaw caused by a potentially backdoored random number generator. It also appears that sometime in 2012 unauthorized changes were made to the parameters used by the NetScreen VPNwhich permitted this back door to be exploited to decrypt and eavesdrop on Juniper VPN connections.
IfCVE-2015-7755 is notenough reason to patch these vulnerabilities as soon as practical, if you use the Juniper VPN functionality, CVE-2015-7756definitely should give you a push to get it applied.
If you are one of those people who likes reading the technical details of cryptography then I highly recommend the excellent writeup by Raif-Phillipp Weinmannat the rpw.sh blog. For a lighter version Matthew Green has a write-up that is less technical but explains the high level details very well.
-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.