Edit Report

Our sensors found this exploit at:

Below is a copy:

Juniper Networks SSL-VPN Client Buffer Overflow

Release Date:
April 25, 2006

Date Reported:
February 27, 2006

Patch Development Time (In Days):
57 Days

High (Remote Code Execution)

Juniper Networks

Software Affected:
Juniper SSL-VPN JuniperSetup Control

Operating Systems Affected:
Windows NT 4.0 (All versions)
Windows 2000 (All versions)
Windows XP (All versions)
Windows 2003 (All versions)

eEye Digital Security has discovered a critical vulnerability in Juniper
Networks SSL-VPN Client ActiveX Control. JuniperSetup.ocx ActiveX
control is automatically loaded throgh the web interface of Juniper
Networks SSL-VPN. There is an exploitable buffer overflow in the
handling a parameter of ActiveX control that will allow a remote
attacker to reliably overwrite the stack with arbitrary data and execute
arbitrary code though the web browser.

Technical Details:
The vulnerability exists in JuniperSetupDLL.dll which is loaded from
JuniperSetup.ocx ActiveX control. If the long string is specified in the
ProductName parameter as follows, the stack based buffer overflow
happens in a function of JuniperSetupDLL.dll.

The vulnerable function is as follows.

.text:04F15783 ; int __stdcall sub_4F15783_ilvdlp(char
*szProductName,LPCSTR lpValueName,LPBYTE lpData,LPDWORD lpcbData)
.text:04F15783 sub_4F15783_ilvdlp proc near
.text:04F15783 SubKey          = byte ptr -10Ch
.text:04F15783 Type            = dword ptr -8
.text:04F15783 hKey            = dword ptr -4
.text:04F157BF                 lea     eax, [ebp+SubKey]
.text:04F157C5                 push    offset szUninstallRegistryKey
.text:04F157CA                 push    eax
.text:04F157CB                 call    strcpy
.text:04F157D0                 push    [ebp+szProductName]
.text:04F157D3                 lea     eax, [ebp+SubKey]
.text:04F157D9                 push    eax
.text:04F157DA                 call    strcat

.data:04F1EA10 ; char szUninstallRegistryKey[]
.data:04F1EA10 szUninstallRegistryKey db

The first argument (szProductName) of this function is the product name
which is used to create the uninstall registry key. The value field of
"ProductName" parameter is passed into the szProductName, copied into
the local buffer "SubKey" using strcat() function without any boundary
checking. So, if we pass the specially crafted "ProductName" parameter,
we can overwrite the return address in the stack and execute arbitrary
code. This is straight classical stack based buffer overflow

Retina Network Security Scanner has been updated to identify this
Blink - Endpoint Vulnerability Prevention - preemptively protects from
this vulnerability.

Vendor Status:
Juniper Networks has released an alert (PSN-2006-03-013) and patch to
address this vulnerability.

Discovery: Yuji Ukai

SCS guys, they are rock !

Copyright (c) 1998-2006 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express
consent of eEye. If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please email
alert (at) eEye (dot) com [email concealed] for permission.

The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are no warranties, implied or express, with regard to this information.
In no event shall the author be liable for any direct or indirect
damages whatsoever arising out of or in connection with the use or
spread of this information. Any use of this information is at the user's
own risk.

Copyright ©2023 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.