Juniper Junos OS Vulnerability (JSA100056)

#TRUSTED 2b56151914d7cd262c6be94ba960f3eb9613b3848123732ab00014764c014c2f7867791fd424098c2a1ea38a0cbef6f56bebee55d96e5eddfef5bd5aa2017b674026ed63666da1fe9e9c3e69a086434ef117c4821ed249a3e72b263ecef5b5ad17ad0b436a1d3ed54ec74f6f8bffcec27ac9195f2295427ba0af129c0e758458083f3393930350888ac60a256b8095f9ac766c05a33988bf1ef0e88578ebc4544f966727906c773c526de22d5b29525c0cec33a8dc90e569aec31006a16dc37c11e18cd7db4cf833240527801cf01d6b12ffd243fd3e3893409c789712e3d254971107a2163e0b33598fdf0bfd57ef21b3cf482c577b94a74b9b85873e4dabef0e7111c82de78aed180db0b630ebb11e7b9cb1bb7c793885059d3b2ca3510ae53db30e1129d6ca37c301851f9b60aa7c5e40e57863f1406d6916b9f12bff9aa7a0d6b2868de27ece444ee6945afbd24d3f4eef39747ebfacb2e88e56caa52971636034c09ab5703be25c991c6156ac55761d40d00664cf6d5239fd6ef02c566d1772760c673f0ee26bcb8ce5de26fb8e68123e55ec23edb434270aea8c3a61aaf440a92382036b272243c09336b4811bb1b022a501c8a3b7380dc8ce168c4b9e628250680c41627c46284ed742a26a7c0d75acc121eb15f2a609ae8c548f0934114e6af35964e1e691d687330a0c8b369b9603bbc2a00a8ab96352bf579f307a
#TRUST-RSA-SHA256 4f75757272e6872ee5ffe05b593ea20ed56d18bba88ff05e0fff90a5de1326cc582005c83ccb95c74b919eeae1a7e39761799f460409338f89f27c22d7bac3992b7656f7ecf09a0e212350e7cca771ef6f3e5bc7dd5745a260b095fba61df9c383769282a2f0edb435dd72e8fa854dd2eb2a259306c99bc991cfe96f099540d4a75cb1efa93038f9acba9c3327d502a382ba7181ab22616f36e9f9557652d4ed345953508147711cbb8ac83d8b2d6f5256dd35dce779bf10fc9ec54ff1c4a8ebade7d779ba0e4553b6eda74087effce6b417d30599eab3dd6358981908b5fcfad76b4bc6b465abf090b2d8557b62b915fbe3ca908b94de1537bbcf35f4b29a8de51e2432d8ad81c21437ccf19b53c6effec539b3e7045a86f092cdec79689218cf7183550b40ee73445f4c411360dd271a7c05661da5e0c9ec6377733f69aa911e8c4e3a5644828669803cd29582b56633e7980499fa91e10cd55c3e99020fce375759fa1a21af708084cbe6b9e9e9abc7ad70a02b49550b6db78c13aa2560dcf30141133520c347ae872133fa4e9621c245fe4a81759e85c2d379d80e0cc09b0c088e467a7b658853f7abcaa2bdd8672de2b2721cb70d10018afc984d147c129ab803337abea6a442621766461949764b9a093fb20a55a9cc6ba08e4b55452dbcba3db82e7d9ebb9d441dca6bea85106e69c65578424111950b8f1635669bd6
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
# This file was created in whole or in part by AI.
##

include('compat.inc');

if (description)
{
  script_id(305574);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/08");

  script_cve_id("CVE-2024-3596");
  script_xref(name:"JSA", value:"JSA100056");

  script_name(english:"Juniper Junos OS Vulnerability (JSA100056)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA100056
advisory.

  - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any
    valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-
    prefix collision attack against MD5 Response Authenticator signature. (CVE-2024-3596)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2025-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Vulnerability-in-the-RADIUS-protocol-for-Subscriber-Management-Blast-RADIUS-CVE-2024-3596
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fe84ec56");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA100056");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/R:A");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-3596");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/08");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');


var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S7'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R3-S7'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R2-S4'},
  {'min_ver':'23.4', 'fixed_ver':'23.4R2-S5'},
  {'min_ver':'23.4-EVO', 'fixed_ver':'23.4R2-S5-EVO'},
  {'min_ver':'24.2', 'fixed_ver':'24.2R2-S1'},
  {'min_ver':'24.2-EVO', 'fixed_ver':'24.2R2-S1-EVO'},
  {'min_ver':'24.4', 'fixed_ver':'24.4R1-S3', 'fixed_display':'24.4R1-S3, 24.4R2'},
  {'min_ver':'24.4-EVO', 'fixed_ver':'24.4R1-S3-EVO', 'fixed_display':'24.4R1-S3-EVO, 24.4R2-EVO'}
];

var override = TRUE;
var buf1 = junos_command_kb_item(cmd:'show configuration | display set');
if (buf1)
{
  var conf1 = !junos_check_config(buf:buf1, pattern:"^set .*access radius-server");
  var conf2 = !junos_check_config(buf:buf1, pattern:"^set .*access profile \S+ radius-server");
  if (conf1 && conf2)
    audit(AUDIT_OS_CONF_NOT_VULN, 'Junos OS');
  override = FALSE;
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_HOLE);