CVE-2005-2640

Behavioral discrepancy information leak in Juniper Netscreen VPN running ScreenOS 5.2.0 and earlier, when using IKE with pre-shared key authentication, allows remote attackers to enumerate valid usernames via an IKE Aggressive Mode packet, which generates a response if the username is valid but does not respond when the username is invalid.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2005-08-23

Last modified

2024-08-07

Affected products

• Netscreen-5gt (Juniper)
• Netscreen-idp (Juniper)
• Netscreen-idp 10 (Juniper)
• Netscreen-idp 100 (Juniper)
• Netscreen-idp 1000 (Juniper)
• Netscreen-idp 500 (Juniper)
• Netscreen Screenos (Juniper)
• Instant Virtual Extranet (Neoteris)
• Netscreen-sa 5000 Series (Netscreen)
• Netscreen-sa 5020 Series (Netscreen)
• Netscreen-sa 5050 Series (Netscreen)
• Ns-10 (Netscreen)
• Ns-100 (Netscreen)
• Ns-204 (Netscreen)
• Ns-500 (Netscreen)
• Ns-50ns25 (Netscreen)

References

• http://marc.info/?l=bugtraq&m=112438068426034&w=2
• http://secunia.com/advisories/16474/
• http://securitytracker.com/id?1014728
• http://www.nta-monitor.com/news/vpn-flaws/juniper/netscreen/index.htm
• http://www.securityfocus.com/bid/14595