Error handling in the SSH protocol, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it possible for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session.

The most straightforward solution is to use CTR mode instead of CBC mode, since this renders SSH resistant to the attack. AES CTR mode ciphers are not vulnerable to this attack. The list of negotiated key exchange encryption ciphers has been modified in Junos to change the order to prefer CTR modes rather than the affected CBC modes.

All Junos software releases built on or after 2010-06-25 have been modified to prefer CTR modes. Releases containing the fix specifically include: 8.5S9, 9.3S12, 10.0S6.1, 10.0R4, 10.1S3.1, 10.1R3, 10.2S1, 10.2R2 and all subsequent releases (i.e. all releases built after 10.2R2).

This issue is being tracked as PR 497505 and is visible on the Customer Support website.

Note that ScreenOS is not vulnerable to this issue.

KB16765 [juniper.net] - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies.

Workarounds

Choose a cipher on the SSH client which is not in the CBC mode family.
For example:
 

2011-04-08: Initial publication
2015-10-20: Added note that ScreenOS is not vulnerable
2018-11-08: Fixed missing SecureCRT screen capture

• CVE-2008-5161