NetSight
IP …
medium5.0Public exploit code

CVE-2005-2640

Behavioral discrepancy information leak in Juniper Netscreen VPN running ScreenOS 5.2.0 and earlier, when using IKE with pre-shared key authentication, allows …

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Behavioral discrepancy information leak in Juniper Netscreen VPN running ScreenOS 5.2.0 and earlier, when using IKE with pre-shared key authentication, allows remote attackers to enumerate valid usernames via an IKE Aggressive Mode packet, which generates a response if the username is valid but does not respond when the username is invalid.

Affected products

VendorProductAffected versions
NeoterisInstant Virtual Extranet
Versions 3.0, 3.1, 3.2, 3.3, 3.3.1
JuniperNetscreen Screenos
Versions 1.7, 1.64, 1.66, 1.66_r2, 1.73_r1, 1.73_r2
NetscreenNs-10
All versions
NetscreenNs-100
Version 3.0_.pe1.0
NetscreenNs-204
Versions 5.0.0_r6.0, 0110.0_11_4.0_r10.0, 0110.0_11_5.1.0_r3a
NetscreenNs-500
Versions 4110.0_11_4.0_r10.0, 4110.0_11_5.1.0_r3a
NetscreenNs-50ns25
Version 5.0.0_r6.0
JuniperNetscreen-5gt
Version 5.0
JuniperNetscreen-Idp
Versions 3.0, 3.0r1, 3.0r2
JuniperNetscreen-Idp 10
Version 3.0.1_r1
JuniperNetscreen-Idp 100
Version 3.0.1_r1
JuniperNetscreen-Idp 1000
Version 3.0.1_r1

References