Juniper Junos OS Multiple Vulnerabilities (JSA100061)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242166);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/17");

  script_cve_id(
    "CVE-2020-10136",
    "CVE-2024-7595",
    "CVE-2025-23018",
    "CVE-2025-23019"
  );
  script_xref(name:"JSA", value:"JSA100061");
  script_xref(name:"CEA-ID", value:"CEA-2020-0049");

  script_name(english:"Juniper Junos OS Multiple Vulnerabilities (JSA100061)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the
JSA100061 advisory.

  - IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network
    interface. (CVE-2025-23019)

  - IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the
    source of a network packet, allowing an attacker to spoof and route arbitrary traffic via an exposed
    network interface. This is a similar issue to CVE-2020-10136. (CVE-2025-23018)

  - GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an
    attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing,
    access control bypass, and other unexpected network behaviors. This can be considered similar to
    CVE-2020-10136. (CVE-2024-7595)

  - IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and
    route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due
    to the lack of validation to verify network packets before decapsulation and routing. (CVE-2020-10136)

  - An insecure configuration flaw was found in the GRE and GRE6 Protocols. When configured to not require
    authentication or filtering, this issue could allow a remote unauthenticated attacker to spoof packets or
    bypass access controls. (CVE-2024-7595)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://kb.cert.org/vuls/id/199397");
  # https://supportportal.juniper.net/s/article/2025-07-Security-Bulletin-Junos-OS-Evolved-Multiple-vulnerabilities-resolved-for-Insecure-Implementation-of-Tunneling-Protocols-GRE-IPIP-4in6-6in4-VU-199397
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?74845834");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA100061");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-10136");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-23019");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/06/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/16");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');


var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0-EVO', 'fixed_ver':'22.2R3-S6-EVO'},
  {'min_ver':'22.4-EVO', 'fixed_ver':'22.4R3-S7-EVO'},
  {'min_ver':'23.2-EVO', 'fixed_ver':'23.2R2-S4-EVO'},
  {'min_ver':'23.4-EVO', 'fixed_ver':'23.4R2-S4-EVO'},
  {'min_ver':'24.2-EVO', 'fixed_ver':'24.2R2-EVO'}
];

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
var report = get_report(ver:ver, fix:fix);
security_report_v4(severity:SECURITY_WARNING, port:0, extra:report);