Juniper Junos OS Vulnerability (JSA103151)

#TRUSTED 4d14e373ce7cdcb0477a66b96082b6a5d1082aaad8c86be46c71e0a748817b677d207552a6c9c53d089ad7aea23ed53f9d9462805d0ee49ebb32d0644f7d1a7e4408d92e3aff1ee351710372686954fe42f8a6d54029315d1b93e1dfc666e4e0752c53b9cbf8b77961d275131f6e6bd69fdbbf155a3d3c190ed452aa07d2946b034057c7dceecc47802d750cf1ab5ceffba9aa5e7f32fb0d157c4f9e5e2585afd193dd5d18715afc3de7c89279643bb9ae96a7d54ab19fc25d53bc3291526025743b8c476da9853121fe622e3af6444cadba854f06bb46f602fe764738c35dd28190ecd8b1109bb50fbae36deab940be42503d3e8b316fec50dd1d27944c175ab16ebfc664b3caeb57440b510bbb7495f99d4d30792b03239e148367921d384bc74a92d15f55cd9ef63749168c3a40ad9c54224fd19ad0cc8f9773ab8210c3525ccddf5b99b9f44bc5eb18ed81f61226ab01bfd2ed718f1def37b38b853a2a0f52ae20f008de98f7799d64525c6c02e16a3afda7fb4cecc7a9f541b0f05438063e0862b17d8c2326262e8fa68e0b76fe566776543529655f09eb89a722dc648a9a0d3e454f09405e66cb950d7966d021cc101bfa07dad9603fdc64b8ab6c588f5ef18cfcf504cbe42883648bc1e7690e4b089b3a6135d53d17ad75da8cfe8533fc2ea6c63a98953597b5914b609fa818fd34c7f15c698480ac88f3a71b181340
#TRUST-RSA-SHA256 6ac72d67af4236da3da4a50003c2a3c70e093c0f4c02b6f7888f50d351399626f04af082a8afaf291ad311e7049f1ae21f71b7c1fd95eea7ea564846fa24f9111e81881ea675d658792d90bfb4d481c48fdf64517f34e98604d4b48d688b17180d584f7e190715bda68ff113aaa548dc0f59c8dcef0327d1219bbcd23e6bc2d35ef9c78b15e40a7e8f39cf6cd8ee051262c3163dd4d9d6cf645b5992df2ab1bee7b5189236a957b1784fc32bd4d5857153a639abb91edf30bd214a1a4cf177b82248491ebdde0be95584ee30519abce96ca9b9b9bd49f7bd2f360c697b765a0568ce0c9374bf453fdcdc8f3096ff0968a85c0a653ed998e6093b9a0da9616ff1ff0573e07f074c9784676e7aa28490e36213f26d52167d90be128f441e57a83366d566b678c79a8ddfcfdaa44cac3fe873e9d0916f383d810671fae28778d9a8d0faea4f47f8d9275e2192c72b1f2f4d40774735e9cc43b5010dce5b716173f6992c7d72dc33855b9f6499deeb30d5d230df025d5c70176115f1d8f70435dd343907583613095d3600f05bf644bbde21e8df0fa257d670216ed76ff1afbe5f4ee3aeef8293f8bc203f9f9f4a34fd1940379abbcfbc6e701f772b8cbc90ef4decc7561e8cfd2d380e6385e1dffe82868ffeb1e01de46ec5a11d8846b03fc2e1569b2a7371a128ca7f54f7ae5c56ed1837e803bd25bd92d8bda9148a1534ce0e1e
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271807);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/28");

  script_cve_id("CVE-2025-59962");
  script_xref(name:"JSA", value:"JSA103151");
  script_xref(name:"IAVA", value:"2025-A-0740");

  script_name(english:"Juniper Junos OS Vulnerability (JSA103151)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA103151
advisory.

  - An Access of Uninitialized Pointer vulnerability in the routing protocol daemon (rpd) of Juniper Networks
    Junos OS and Junos OS Evolved with BGP sharding configured allows an attacker triggering indirect next-hop
    updates, along with timing outside the attacker's control, to cause rpd to crash and restart, leading to a
    Denial of Service (DoS). (CVE-2025-59962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-BGP-sharding-enabled-change-in-indirect-next-hop-can-cause-RPD-crash-CVE-2025-59962
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c8d75e8f");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA103151");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:H/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/AU:Y/R:A/V:C/RE:M");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-59962");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/28");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');


var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'21.4R3-S6'},
  {'min_ver':'0.0-EVO', 'fixed_ver':'22.3R3-S3-EVO'},
  {'min_ver':'22.1', 'fixed_ver':'22.1R3-S6'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S3'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R3-S3'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R3'},
  {'min_ver':'22.4-EVO', 'fixed_ver':'22.4R3-EVO'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R2'},
  {'min_ver':'23.2-EVO', 'fixed_ver':'23.2R2-EVO'}
];

var override = TRUE;
var buf = junos_command_kb_item(cmd:'show configuration | display set');
if (buf)
{
  override = FALSE;
  if (!junos_check_config(buf:buf, pattern:"^set system processes routing bgp rib-sharding", multiline:TRUE))
    audit(AUDIT_OS_CONF_NOT_VULN, 'Junos OS');
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);

junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_WARNING);