Vigil@nce - Juniper QFX: low entropie
June 2015 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can potentially guess SSH or signature keys used by
Juniper QFX.
Impacted products: JUNOS
Severity: 2/4
Creation date: 08/04/2015
DESCRIPTION OF THE VULNERABILITY
The Juniper QFX product uses the RANDOM_INTERRUPT entropy source,
in order to generate random numbers.
However, the number of collected bytes is too low to ensure that
randoms generated after the boot are not predictable.
An attacker can therefore potentially guess SSH or signature keys
used by Juniper QFX.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Juniper-QFX-low-entropie-16561