The Channel logo


By | Richard Chirgwin 16th March 2016 03:02

Juniper starts waving fixes for DROWN vuln

Turn off SSL, install patches, block traffic at firewalls

Juniper Networks has identified products it says are vulnerable to the DROWN attack.

DROWN turned up at the end of February, and is a relic of enduring but pointless support for the long-deprecated SSLv2 protocol.

The most prominent exposure to DROWN is in web sites that weren't configured to refuse attempts at SSLv2 connection. However, hardware vendors use HTTPS to secure access to management consoles, which means the vulnerability sent the whole industry scrambling to identify and patch vulnerable systems.

In Juniper's advisory, the company says its ScreenOS (the operating system for NetScreen firewalls), Security Threat Response Manager (STRM), its JSA virtual appliance, and its WLC Wireless LAN Controller had the DROWN vulnerability.

For ScreenOS later than version 6.3.0r19, the fix is straightforward: disable SSLv2 and SSLv3 at the CLI with the <ttl>unset sll ssl3 command.

The company promises a fix for the STRM and JSA Series products in versions 2014.6.r4 and 2013.2.r14, and fixes are promised for other products.

Listed as not vulnerable are Junos OS, Junos Space, JunosE, QFabric Director, Standalone IDP (intrusion detection and prevention), NSM, WLAN RingMaster and WLAN SmartPass.

If you have vulnerable products that don't yet have a fix, Juniper notes that SSL traffic can be blocked at the firewall. ®

comment icon Be the first to post a comment! alert Send corrections


Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella

Chris Mellor

Thousands of layoffs announced as spinning rust enters its death spiral


STRASBOURG, JUNE 29, 2016: The seat of the European Parliament. by Marco Aprile for shutterstock. EDITORIAL USE ONLY
Plan b, image via Shutterstock
EU workers, new markets: post-Brexit pressure on May & Co
Tough question, pic via Shutterstock
Honest mistake with your licensing? Audit police look at it on a 'case by case basis'