Vulnerability in Juniper Netscreen-5gt
CVE-2005-2640
Behavioral discrepancy information leak in Juniper Netscreen VPN running ScreenOS 5.2.0 and earlier, when using IKE with pre-shared key authentication, allows remote attackers to enumerate valid usernames via an IKE Aggressive Mode packet, which generates a response if the username is valid but does not respond when the username is invalid.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.071 (94.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 94.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.071 · newest: 0.071 · change: 0.000
Affected products
- Juniper Netscreen-5gt — versions 5.0
- Juniper Netscreen-Idp — versions 3.0, 3.0r1, 3.0r2
- Juniper Netscreen-Idp 10 — versions 3.0.1_r1
- Juniper Netscreen-Idp 100 — versions 3.0.1_r1
- Juniper Netscreen-Idp 1000 — versions 3.0.1_r1
- Juniper Netscreen-Idp 500 — versions 3.0.1_r1
- Juniper Netscreen Screenos — versions 1.7, 1.64, 1.66
- Neoteris Instant Virtual Extranet — versions 3.0, 3.1, 3.2
- Netscreen Netscreen-Sa 5000 Series
- Netscreen Netscreen-Sa 5020 Series — versions 4.2_r2.2
References
- www.securityfocus.com/bid/14595 (Exploit, vdb-entry)
- marc.info/ (mailing-list)
- www.nta-monitor.com/news/vpn-flaws/juniper/netscreen/index.htm (Exploit, Vendor Advisory)
- securitytracker.com/id (vdb-entry)
- secunia.com/advisories/16474/ (Vendor Advisory, third-party-advisory)