Juniper's advisory claimed that versions 6.2.0r15 to 6.2.0r18 and 6.3.0r12 to 6.3.0r20 were affected, but the authentication backdoor is not actually present in older versions of ScreenOS. The interesting thing about this backdoor is not the simplicity, but the timing. If it's the NSA ( which looks possible, given one leak about a program called 'FEEDTROUGH' that installs persistent backdoors in Juniper devices) then it will mean that the US government deliberately sabotaged tens, if not hundreds, of thousands of networks that were protected by products from a US company that is the second-largest provider of networking equipment in the world, after Cisco. In this case, someone deliberately inserted a backdoor password into Juniper's devices. Security advisories usually relate to vulnerabilities arising from defects - mistakes programmers made. The next mystery to solve is where this unauthorized code comes from. The password is <<< %s(un='%s') = %u, 'presumably chosen so that it would be mistaken for one of the many other debug format strings in the code.' Rapid7 was able to easily locate 26,000 Juniper devices that are vulnerable to this attack.

Rapid7's Hdmoore reports that he and his team have confirmed that 'unauthorized code' is a backdoor whose secret password enables the wielder to telnet or ssh into Juniper's appliances.

The company raised alarm bells with a late-day-on-a-Friday advisory announcing that they'd discovered 'unauthorized code' in some versions of Screen OS, a strange occurrence that hinted at a security agency or criminal enterprise had managed to tamper with the product before it shipped. Juniper Networks makes a popular line of enterprise firewalls whose operating system is called Screen OS.

Juniper mag2600