CVE-2002-2266: Medium severity Netscreen ScreenOS vulnerability
NetScreen ScreenOS 2.8 through 4.0, when forwarding H.323 or Netmeeting traffic, allows remote attackers to cause a denial of service (firewall session table consumption) by establishing multiple half-open H.323 sessions, which are not cleaned up on garbage removal and do not time out for 36 hours.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable forwarding of H.323 and Netmeeting traffic on NetScreen ScreenOS devices to prevent creation of multiple half-open H.323 sessions that consume the firewall session table.
NetScreen ScreenOS H.323/Netmeeting forwarding = disabled - Compensating control
Block or filter H.323 and Netmeeting traffic at the network perimeter (firewall/ACL/WAF) or restrict such traffic to trusted hosts only to prevent remote attackers from establishing multiple half-open H.323 sessions.
Event History
Frequently Asked Questions
What is the severity of CVE-2002-2266?
CVE-2002-2266 has a severity level of high due to its potential to cause denial of service.
How do I fix CVE-2002-2266?
To fix CVE-2002-2266, update to a patched version of NetScreen ScreenOS that addresses this vulnerability.
What versions of NetScreen ScreenOS are affected by CVE-2002-2266?
CVE-2002-2266 affects NetScreen ScreenOS versions 2.8 through 4.0.
What type of attack does CVE-2002-2266 enable?
CVE-2002-2266 enables attackers to exploit half-open H.323 sessions, leading to session table consumption.
Is there a workaround for CVE-2002-2266 if an update cannot be applied?
Enabling stricter access controls or firewall rules may help mitigate the effects of CVE-2002-2266 in the absence of an update.