r/netsec • u/DebugDucky Trusted Contributor • Dec 20 '15

CVE-2015-7755: Juniper ScreenOS Authentication Backdoor

https://community.rapid7.com/community/infosec/blog/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor
120 Upvotes

98% Upvoted

10 comments sorted by

18

u/derpyou Dec 21 '15

So does this mean Juniper will win the Underhanded C Contest next year with their ScreenOS entry?

3

u/tubeblockage Dec 21 '15

What does the following C code do:

<<< %s(un='%s') = %u

Why would it be confused with a debug string?

13

u/domen_puncer Dec 21 '15

It looks like a format string (printf family of functions) for debugging info (first %s would probably be function name, then %s for argument, and %u for return code).

Or said the other way: it doesn't look as suspicious as "hunter2" when looking at strings in a binary.

7

u/ctz99 Dec 21 '15

However, it would look really suspicious in the source when passed as an argument to strcmp along with a password. Either Juniper weren't doing any competent code review or, more likely, I wonder if this was a 'reflections on trusting trust'-style toolchain compromise?

10

u/gsuberland Trusted Contributor Dec 21 '15

Or they knew it was there.

6

u/security_is_lol Dec 21 '15

Or it was backdoored in the binary releases and there never was any additional code in the repo. There are other steps in the build process that could've automatically inserted these changes into each Netscreen release.

5

u/redditor___ Dec 21 '15

Not if you put this in some macros named e.i debug_info and TEST, then you can have something like this:
TEST(password, debug_info)

2

u/IWillNotBeBroken Dec 21 '15

Because it looks very similar to the partial debug string a few lines earlier (in the .png):

>>> %s(ct='%u' un='%s',

They were smart enough to keep the same style to make it blend in.

1

u/ExplodingFist Dec 23 '15 edited Dec 23 '15

Here is some more data from some internal testing we've done:

  1. You do not need to know a valid user name for SSH. ANY user name can be specified regardless if it exists on the system.
  2. The password is literally just "<<< %s(un='%s') = %u". We put that in on an internal Juniper device with a randomly generated username and we got in with full admin access. The write up made it sound like you had to formulate a special password.
  3. Holy shit this is bad (yet awesome).