A vulnerability has been reported against virtually all versions of OpenSSL stating that client-initiated renegotiation is not properly restricted within the SSL and TLS protocols. This might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection. Some network services in Network and Security Manager (NSM) utilizing SSL/TLS were found vulnerable to this issue.

This issue has been assigned CVE-2011-1473.

Network services in NSM utilizing SSL/TLS have been fixed to resolve this vulnerability.
NSM Releases containing the fix specifically include:

• 2010.3s13
• 2011.4s10
• 2012.1R7
• 2012.2R3

Use access lists or firewall filters to limit access to NSM from only trusted networks.

• KB16613: Overview of the Juniper Networks SIRT Monthly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2011-1473 OpenSSL does not properly restrict client-initiated renegotiation