Juniper Junos OS Vulnerability (JSA100080)

#TRUSTED ae491d51b21d661e29c6ecbac0521e29411c96f81c84d1c30f1cbf18aeac84f843118dbce773b0bcb56e06068ded37c0f3391485814e6998da545f59dd8c34257c65d66bb8aa302e33a00f37bb6df64a92a885adc16ba22ec912390ec45cfc8ee83cfeac6649e5039d3d4c81e9061c07ae0f832f3f5b605b518c9fa218410e4dbb9c086b8c2a6caacfe24f498d5aeb7f5f4bcea1bc1de85b35196ebd761870f8bd58dcbc60a1715880cb6e8add8fe5263fca1d9ceb77d2c944748ec0d8c2f65a093cbffddaf2e3b6fad3abaf0e2a48f91e0f346873c78323de4ca5f789efe0f52f52c89e136d1fe43bf7313373ce64d5fd508f09f0ddd5ac8463068851793e1a7de4b6637d54532293c1fffa50512ffbef7fea3b917429d037d4ee7fb32b793aaddcfaa91cd1df0897339170840ed7499fe0a5f90cc2f2eae0f4f65724dd7813a8f50e354e736d20851bf4a5fb03cafbcd309d7c69459d6670177c86dab86d81da31c429d3f87a40e0f8d3d8ee199051c98b94dc681d9af5b04052682e7ac798bf45730b77d20affc11193fb0c7d5b4f69600876ba5b77e03c2094210ce59be306df02fbb333e42645c5328a10266cd7136c5004055e0a3c63a450908d26a15406b43e23293048821d01a87c1a10af76b144445dc2397bc6f4652869c07280433da80058d3cf48bfd59f012fd5b1212e881607c390a2c96d2a309dc988ab2151
#TRUST-RSA-SHA256 7245173f6d0d9ec127660c7fe3a2804f4782f4fa2ce990666b02d219ecc3d0cd9a7b4fe2b0d508932b3d588dec4eb4435de87c9c3bd8e22056c4b2511896906e47d59904c8d486487e33b370ad95b875aa37897025b508b0193cbb2c41ef65b85f454e17e97381d667790f232e3325569352b0aa8d3a71c7444cfdedade00327824d2714a069333ffe08dffaa35a6f1cac5cd6a742c45ff4d8060c7cec22a6bb5c8753814523d28ad79983b839f10f80449eb09b67c1166f70a3dc8a4009c36ea9a24b560239b9914da88a51088f10503c8bc8d3010f309c215f45dbbb9f53e03e9935e4d360ab96e13edfe171ff542ba636768ac39007172c737d5377f3c8c6a0bbc16ba69ccefb9eb0f4547683bf1831c436355f0c9597a0d9244fff9b4deff0376b60bd8157488a0b2aaa2fe3560da71fb97259c7464e098e8e2abdb7e537750a2dfa7426018d69aa290529b2499bab51fd6ef14f6f3ba347ecbfe05309a0a3571c15ae8eb5efda55514e2f3ab4d82a25d52430f9ec49f7fde32b08d5eff147ffe77b5fe875d8a37dff5512a57ed50c3c87f90cc41a122b3469e9c76133b549ee3b691c83a21a585c220b323078ab19dfff973e0903c22f5a66640ab825608fc1aa098eb0cf506d8176fa78aff2896ef06bfd4f4d222537d8a211d13dbd305e100a63f9a666a12b4e438d6e27e514154ffbb1c8975be574372f5caddd5063
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
# This file was created in whole or in part by AI.
##

include('compat.inc');

if (description)
{
  script_id(310753);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/28");

  script_cve_id("CVE-2025-52964");
  script_xref(name:"JSA", value:"JSA100080");

  script_name(english:"Juniper Junos OS Vulnerability (JSA100080)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA100080
advisory.

  - A Reachable Assertion vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and
    Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).
    When the device receives a specific BGP UPDATE packet, the rpd crashes and restarts. Continuous receipt of
    this specific packet will cause a sustained DoS condition. For the issue to occur, BGP multipath with
    pause-computation-during-churn must be configured on the device, and the attacker must send the paths
    via a BGP UPDATE from a established BGP peer. This issue affects: Junos OS: * All versions before
    21.4R3-S7, * from 22.3 before 22.3R3-S3, * from 22.4 before 22.4R3-S5, * from 23.2 before 23.2R2, * from
    23.4 before 23.4R2. Junos OS Evolved: * All versions before 21.4R3-S7-EVO, * from 22.3 before
    22.3R3-S3-EVO, * from 22.4 before 22.4R3-S5-EVO, * from 23.2 before 23.2R2-EVO, * from 23.4 before
    23.4R2-EVO. (CVE-2025-52964)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2025-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Junos-OS-and-Junos-OS-Evolved-Receipt-of-a-specific-BGP-UPDATE-causes-an-rpd-crash-on-devices-with-BGP-multipath-configured-CVE-2025-52964
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?937e1b70");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA100080");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-52964");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/28");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');


var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'21.4R3-S7'},
  {'min_ver':'0.0-EVO', 'fixed_ver':'21.4R3-S7-EVO'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R3-S3'},
  {'min_ver':'22.3-EVO', 'fixed_ver':'22.3R3-S3-EVO'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R3-S5'},
  {'min_ver':'22.4-EVO', 'fixed_ver':'22.4R3-S5-EVO'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R2'},
  {'min_ver':'23.2-EVO', 'fixed_ver':'23.2R2-EVO'},
  {'min_ver':'23.4', 'fixed_ver':'23.4R2'},
  {'min_ver':'23.4-EVO', 'fixed_ver':'23.4R2-EVO'}
];

var override = TRUE;
var buf1 = junos_command_kb_item(cmd:'show configuration | display set');
if (buf1)
{
  var conf1 = !junos_check_config(buf:buf1, pattern:"^set .*protocols bgp group \S+ multipath");
  var conf2 = !junos_check_config(buf:buf1, pattern:"^set .*protocols bgp group \S+ multipath pause-computation-during-churn");
  if (conf1 || conf2)
    audit(AUDIT_OS_CONF_NOT_VULN, 'Junos OS');
  override = FALSE;
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_WARNING);