Juniper Junos SRX Series ALG 'flowd' Remote DoS (JSA10650)
2014-10-14T00:00:00
ID JUNIPER_JSA10650.NASL Type nessus Reporter Tenable Modified 2017-05-16T00:00:00
Description
According to its self-reported version number, the remote Juniper Junos SRX series device is affected by a denial of service vulnerability related to ALG (Application Layer Gateway). A remote attacker can exploit this issue by sending a specially crafted SIP packet to an SRX series device, resulting in a crash of the 'flowd' process. Repeated exploitation may result in the device becoming unresponsive.
Note that this issue only affects devices with any ALGs enabled or if flow-based processing for IPv6 traffic is enabled. All SRX devices, except for SRX-HE devices, have the SIP ALG enabled by default.
#TRUSTED 1298b96d4234724afee29ed720f81707b479bcf6657ab848a5ce453819919100f5b81c65e81aa28a07b33ce4d31548dddf9c7d854466349235855e3460ce4b61ddc38a1be4edaff32ec415e2de40e1332977755329301f49fa57f352ab45d98631db88e675f7f62181349db8d1328799e5a06598a97fe80375f60860fb04c1c60a824c65b5e7dd01bfb094b63936dedc7417990fe23c3a851adddb80c524f1df4d4a34b07d630a0c30a49d1f6121994946a98c658e058ee3d352b439a7cd5cb7db35dd2777e78dd0781ff9d0ae6b1fcbca047e1e2aa6adacca453c5075b434000cfc6dc5cac53b48ddff00b99e06f5166174f7796b70b4a22e0a20bb7fffdaebae9b46c3d4c9fa4320139a4688f0570bcb4821f68e9543464b58608675959ea71b9d8ced4baccbf17e0cfaded02d78c405a9c7874b7b961f1c8d121f6ac10e03c1057a730f0bd9da9d35897ce9f011fc9de7ec23fc46882b531efb6d10ca40ca92ffbea9264f9e88bc6592ba674a7f5691b6c0db43a26ea5ac9cbe55af424fc1b3ffd552e8f7681b71190cf712483e5ea402eb9d30f491639142c1153a79fa635f8946fb9e6ec13b1c2a62e4af97c5ce8013eec02ba66d3fa58feb2217bfe28666a6eb897545cb23b3df58800f2bd543391326f2e3917d51930a5b2d4166f289efb90b014528f6e52291cabb30fc6aa50837db183c8375fb06c855a61f4f8c68
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(78421);
script_version("1.7");
script_set_attribute(attribute:"plugin_modification_date", value:"2017/05/16");
script_cve_id("CVE-2014-3825");
script_bugtraq_id(70366);
script_osvdb_id(113076);
script_xref(name:"JSA", value:"JSA10650");
script_name(english:"Juniper Junos SRX Series ALG 'flowd' Remote DoS (JSA10650)");
script_summary(english:"Checks the Junos version, model, and configuration.");
script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the remote Juniper
Junos SRX series device is affected by a denial of service
vulnerability related to ALG (Application Layer Gateway). A remote
attacker can exploit this issue by sending a specially crafted SIP
packet to an SRX series device, resulting in a crash of the 'flowd'
process. Repeated exploitation may result in the device becoming
unresponsive.
Note that this issue only affects devices with any ALGs enabled or if
flow-based processing for IPv6 traffic is enabled. All SRX devices,
except for SRX-HE devices, have the SIP ALG enabled by default.");
script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10650");
script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release or workaround referenced in
Juniper advisory JSA10650.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2014/10/08");
script_set_attribute(attribute:"patch_publication_date", value:"2014/07/10");
script_set_attribute(attribute:"plugin_publication_date", value:"2014/10/14");
script_set_attribute(attribute:"plugin_type", value:"combined");
script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Junos Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2014-2017 Tenable Network Security, Inc.");
script_dependencies("junos_version.nasl");
script_require_keys("Host/Juniper/model", "Host/Juniper/JUNOS/Version");
exit(0);
}
include("audit.inc");
include("junos_kb_cmd_func.inc");
include("misc_func.inc");
ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');
model = get_kb_item_or_exit('Host/Juniper/model');
check_model(model:model, flags:SRX_SERIES, exit_on_fail:TRUE);
fixes = make_array();
fixes['11.4'] = '11.4R12-S4';
fixes['12.1X44'] = '12.1X44-D40';
fixes['12.1X45'] = '12.1X45-D30';
fixes['12.1X46'] = '12.1X46-D25';
fixes['12.1X47'] = '12.1X47-D10';
fix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE);
override = TRUE;
# Check if either configurations are enabled
if (get_kb_item("Host/local_checks_enabled"))
{
# Check if flow-based processing for IPv6 traffic is enabled
vuln = FALSE;
buf = junos_command_kb_item(cmd:"show configuration | display set");
if (buf)
{
pattern = "^set security forwarding-options family inet6 mode flow-based";
if (junos_check_config(buf:buf, pattern:pattern))
vuln = TRUE;
override = FALSE;
}
# Check if at least one ALG is enabled
if (!vuln)
{
buf = junos_command_kb_item(cmd:"show security alg status");
if (buf)
{
pattern = ":\s*Enabled$";
if (preg(string:buf, pattern:pattern, multiline:TRUE))
vuln = TRUE;
override = FALSE;
}
}
if (!vuln && !override)
audit(AUDIT_HOST_NOT,
'affected because neither flow-based processing for IPv6 traffic is enabled nor at least one ALG is enabled');
}
junos_report(ver:ver, fix:fix, model:model, override:override, severity:SECURITY_HOLE);
{"id": "JUNIPER_JSA10650.NASL", "bulletinFamily": "scanner", "title": "Juniper Junos SRX Series ALG 'flowd' Remote DoS (JSA10650)", "description": "According to its self-reported version number, the remote Juniper Junos SRX series device is affected by a denial of service vulnerability related to ALG (Application Layer Gateway). A remote attacker can exploit this issue by sending a specially crafted SIP packet to an SRX series device, resulting in a crash of the 'flowd' process. Repeated exploitation may result in the device becoming unresponsive.\n\nNote that this issue only affects devices with any ALGs enabled or if flow-based processing for IPv6 traffic is enabled. All SRX devices, except for SRX-HE devices, have the SIP ALG enabled by default.", "published": "2014-10-14T00:00:00", "modified": "2017-05-16T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=78421", "reporter": "Tenable", "references": ["https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10650"], "cvelist": ["CVE-2014-3825"], "type": "nessus", "lastseen": "2017-10-29T13:35:25", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": [], "cvelist": ["CVE-2014-3825"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "According to its self-reported version number, the remote Juniper Junos SRX series device is affected by a denial of service vulnerability related to ALG (Application Layer Gateway). A remote attacker can exploit this issue by sending a specially crafted SIP packet to an SRX series device, resulting in a crash of the 'flowd' process. Repeated exploitation may result in the device becoming unresponsive.\n\nNote that this issue only affects devices with any ALGs enabled or if flow-based processing for IPv6 traffic is enabled. All SRX devices, except for SRX-HE devices, have the SIP ALG enabled by default.", "edition": 2, "enchantments": {}, "hash": "86282d86c5f0b1e45867034b4428456fe296de84c69b66a187f98db663eaa023", "hashmap": [{"hash": "b81a08b1524756f5980b0ea90881e5e4", "key": "sourceData"}, {"hash": "fe9fd04e43689fba05b082bfa0306f25", "key": "description"}, {"hash": "f44fb98241ad612bdd34e6e796e60393", "key": "naslFamily"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "5584c5a4c503db60b297fd37753044d2", "key": "cvelist"}, {"hash": "b232f0b300d7fd6cb958cccee1d45122", "key": "href"}, {"hash": "c3560fb562d22673fe089f080adde204", "key": "published"}, {"hash": "c39a4e269d9c1ed44b4a53c94a95b52b", "key": "pluginID"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "0bb4c00b1840cb0366374516988bb9e9", "key": "references"}, {"hash": "1aadf38ba4a2a4de198e02a704ba3377", "key": "title"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}, {"hash": "e7c99ea8270f32c4596b63d798cb8592", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=78421", "id": "JUNIPER_JSA10650.NASL", "lastseen": "2017-05-17T02:45:57", "modified": "2017-05-16T00:00:00", "naslFamily": "Junos Local Security Checks", "objectVersion": "1.2", "pluginID": "78421", "published": "2014-10-14T00:00:00", "references": ["https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10650"], "reporter": "Tenable", "sourceData": "#TRUSTED 1298b96d4234724afee29ed720f81707b479bcf6657ab848a5ce453819919100f5b81c65e81aa28a07b33ce4d31548dddf9c7d854466349235855e3460ce4b61ddc38a1be4edaff32ec415e2de40e1332977755329301f49fa57f352ab45d98631db88e675f7f62181349db8d1328799e5a06598a97fe80375f60860fb04c1c60a824c65b5e7dd01bfb094b63936dedc7417990fe23c3a851adddb80c524f1df4d4a34b07d630a0c30a49d1f6121994946a98c658e058ee3d352b439a7cd5cb7db35dd2777e78dd0781ff9d0ae6b1fcbca047e1e2aa6adacca453c5075b434000cfc6dc5cac53b48ddff00b99e06f5166174f7796b70b4a22e0a20bb7fffdaebae9b46c3d4c9fa4320139a4688f0570bcb4821f68e9543464b58608675959ea71b9d8ced4baccbf17e0cfaded02d78c405a9c7874b7b961f1c8d121f6ac10e03c1057a730f0bd9da9d35897ce9f011fc9de7ec23fc46882b531efb6d10ca40ca92ffbea9264f9e88bc6592ba674a7f5691b6c0db43a26ea5ac9cbe55af424fc1b3ffd552e8f7681b71190cf712483e5ea402eb9d30f491639142c1153a79fa635f8946fb9e6ec13b1c2a62e4af97c5ce8013eec02ba66d3fa58feb2217bfe28666a6eb897545cb23b3df58800f2bd543391326f2e3917d51930a5b2d4166f289efb90b014528f6e52291cabb30fc6aa50837db183c8375fb06c855a61f4f8c68\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(78421);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2017/05/16\");\n\n script_cve_id(\"CVE-2014-3825\");\n script_bugtraq_id(70366);\n script_osvdb_id(113076);\n script_xref(name:\"JSA\", value:\"JSA10650\");\n\n script_name(english:\"Juniper Junos SRX Series ALG 'flowd' Remote DoS (JSA10650)\");\n script_summary(english:\"Checks the Junos version, model, and configuration.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote device is missing a vendor-supplied security patch.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its self-reported version number, the remote Juniper\nJunos SRX series device is affected by a denial of service\nvulnerability related to ALG (Application Layer Gateway). A remote\nattacker can exploit this issue by sending a specially crafted SIP\npacket to an SRX series device, resulting in a crash of the 'flowd'\nprocess. Repeated exploitation may result in the device becoming\nunresponsive.\n\nNote that this issue only affects devices with any ALGs enabled or if\nflow-based processing for IPv6 traffic is enabled. All SRX devices,\nexcept for SRX-HE devices, have the SIP ALG enabled by default.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10650\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply the relevant Junos software release or workaround referenced in\nJuniper advisory JSA10650.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/10/14\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"combined\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:juniper:junos\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Junos Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2017 Tenable Network Security, Inc.\");\n\n script_dependencies(\"junos_version.nasl\");\n script_require_keys(\"Host/Juniper/model\", \"Host/Juniper/JUNOS/Version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"junos_kb_cmd_func.inc\");\ninclude(\"misc_func.inc\");\n\nver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');\nmodel = get_kb_item_or_exit('Host/Juniper/model');\n\ncheck_model(model:model, flags:SRX_SERIES, exit_on_fail:TRUE);\n\nfixes = make_array();\nfixes['11.4'] = '11.4R12-S4';\nfixes['12.1X44'] = '12.1X44-D40';\nfixes['12.1X45'] = '12.1X45-D30';\nfixes['12.1X46'] = '12.1X46-D25';\nfixes['12.1X47'] = '12.1X47-D10';\n\nfix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE);\noverride = TRUE;\n\n# Check if either configurations are enabled \nif (get_kb_item(\"Host/local_checks_enabled\"))\n{\n # Check if flow-based processing for IPv6 traffic is enabled\n vuln = FALSE;\n buf = junos_command_kb_item(cmd:\"show configuration | display set\");\n if (buf)\n {\n pattern = \"^set security forwarding-options family inet6 mode flow-based\";\n if (junos_check_config(buf:buf, pattern:pattern))\n vuln = TRUE;\n override = FALSE;\n }\n\n # Check if at least one ALG is enabled\n if (!vuln)\n {\n buf = junos_command_kb_item(cmd:\"show security alg status\");\n if (buf)\n {\n pattern = \":\\s*Enabled$\";\n if (preg(string:buf, pattern:pattern, multiline:TRUE))\n vuln = TRUE;\n override = FALSE;\n }\n }\n\n if (!vuln && !override)\n audit(AUDIT_HOST_NOT,\n 'affected because neither flow-based processing for IPv6 traffic is enabled nor at least one ALG is enabled'); \n}\n\njunos_report(ver:ver, fix:fix, model:model, override:override, severity:SECURITY_HOLE);\n", "title": "Juniper Junos SRX Series ALG 'flowd' Remote DoS (JSA10650)", "type": "nessus", "viewCount": 0}, "differentElements": ["cpe"], "edition": 2, "lastseen": "2017-05-17T02:45:57"}, {"bulletin": {"bulletinFamily": "exploit", "cvelist": ["CVE-2014-3825"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "According to its self-reported version number, the remote Juniper Junos SRX series device is affected by a denial of service vulnerability related to ALG (Application Layer Gateway). A remote attacker can exploit this issue by sending a specially crafted SIP packet to an SRX series device, resulting in a crash of the 'flowd' process. Repeated exploitation may result in the device becoming unresponsive.\n\nNote that this issue only affects devices with any ALGs enabled or if flow-based processing for IPv6 traffic is enabled. All SRX devices, except for SRX-HE devices, have the SIP ALG enabled by default.", "edition": 1, "hash": "3ae4c58e3a551909b455638e7e27e89009c7b2e2be5028875dadcf494629e755", "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "feec9f83775eeda88ee8a9bd6497a027", "key": "sourceData"}, {"hash": "fe9fd04e43689fba05b082bfa0306f25", "key": "description"}, {"hash": "f44fb98241ad612bdd34e6e796e60393", "key": "naslFamily"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "5584c5a4c503db60b297fd37753044d2", "key": "cvelist"}, {"hash": "b232f0b300d7fd6cb958cccee1d45122", "key": "href"}, {"hash": "aed28575e4fec9b7b34e89c683482dde", "key": "references"}, {"hash": "c3560fb562d22673fe089f080adde204", "key": "published"}, {"hash": "91e56bfe53711d2659fd734fdd9681d1", "key": "modified"}, {"hash": "c39a4e269d9c1ed44b4a53c94a95b52b", "key": "pluginID"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "1aadf38ba4a2a4de198e02a704ba3377", "key": "title"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=78421", "id": "JUNIPER_JSA10650.NASL", "lastseen": "2016-09-26T17:23:47", "modified": "2015-12-23T00:00:00", "naslFamily": "Junos Local Security Checks", "objectVersion": "1.2", "pluginID": "78421", "published": "2014-10-14T00:00:00", "references": ["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10650"], "reporter": "Tenable", "sourceData": "#TRUSTED 7caca4a0215b8416bf7081ca231bc6d1a0c163e05d1a83dfe83d1cc5bbea4ffb1879eb54b6c0725b42629ae1e64297098fe1d66c8c13a58442c7923a409ff7453dbb710e1db781ae5f1dee928baf0caace5e8bbdf3d1c6aba3edd1c74d5f4983c82a96130cf382959e5c153cef41964495f489ca2603a903e5cf5fec9d25f74b43fdd86f094b9ac398d1808bba6014cb2127cb1bd384b44922397ac9d6f9ce81f3734f9954c490d617627327c8f2a148bb1cca5185b885d25d80ba49d6af1eab975172c67501184744b6cb215d8e14931305f86612f12bb4fbd26058fde220cc3e1c8049c1831a31813a542b89e72a26964d3a2a03d72488995d0d6aab965a203d1e9b324e56e97b45b703695cdb6c0035ed9f9d3b9c6dcf63ecbe7068b1397901e8e5513da2a0e22d54794819273062010c5fd2746e56363070da1ff6067d98634647fbd805704889ef0f6c8f2c961e03ff2c7675b0e1f638af600d52a5f30dba64f2c4961509fad25cc3fd1a8fc54fcf141cf63b2020b71e8d83d53bfa2ae703513c02f89d45bd74c6f0939631deed96016622788dabb8a966e98cca95d8a55f1b771b93d7c8fd76e5596f387f59c4e13e57efb5a7cbef12d7af0cdf1b2cfeb6b6745217f138f7a48f7e687adb5c0b1f2a419f4fb016a05199f1317011c7e01211591903473335b764a611a5f900a8917fb50191e785623a2af658ee47fbe9\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(78421);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2015/12/23\");\n\n script_cve_id(\"CVE-2014-3825\");\n script_bugtraq_id(70366);\n script_osvdb_id(113076);\n script_xref(name:\"JSA\", value:\"JSA10650\");\n\n script_name(english:\"Juniper Junos SRX Series ALG 'flowd' Remote DoS (JSA10650)\");\n script_summary(english:\"Checks the Junos version, model, and configuration.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote device is missing a vendor-supplied security patch.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its self-reported version number, the remote Juniper\nJunos SRX series device is affected by a denial of service\nvulnerability related to ALG (Application Layer Gateway). A remote\nattacker can exploit this issue by sending a specially crafted SIP\npacket to an SRX series device, resulting in a crash of the 'flowd'\nprocess. Repeated exploitation may result in the device becoming\nunresponsive.\n\nNote that this issue only affects devices with any ALGs enabled or if\nflow-based processing for IPv6 traffic is enabled. All SRX devices,\nexcept for SRX-HE devices, have the SIP ALG enabled by default.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10650\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply the relevant Junos software release or workaround referenced in\nJuniper advisory JSA10650.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/10/14\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"combined\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:juniper:junos\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Junos Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2015 Tenable Network Security, Inc.\");\n\n script_dependencies(\"junos_version.nasl\");\n script_require_keys(\"Host/Juniper/model\", \"Host/Juniper/JUNOS/Version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"junos_kb_cmd_func.inc\");\ninclude(\"misc_func.inc\");\n\nver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');\nmodel = get_kb_item_or_exit('Host/Juniper/model');\n\ncheck_model(model:model, flags:SRX_SERIES, exit_on_fail:TRUE);\n\nfixes = make_array();\nfixes['11.4'] = '11.4R12-S4';\nfixes['12.1X44'] = '12.1X44-D40';\nfixes['12.1X45'] = '12.1X45-D30';\nfixes['12.1X46'] = '12.1X46-D25';\nfixes['12.1X47'] = '12.1X47-D10';\n\nfix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE);\noverride = TRUE;\n\n# Check if either configurations are enabled \nif (get_kb_item(\"Host/local_checks_enabled\"))\n{\n # Check if flow-based processing for IPv6 traffic is enabled\n vuln = FALSE;\n buf = junos_command_kb_item(cmd:\"show configuration | display set\");\n if (buf)\n {\n pattern = \"^set security forwarding-options family inet6 mode flow-based\";\n if (junos_check_config(buf:buf, pattern:pattern))\n vuln = TRUE;\n override = FALSE;\n }\n\n # Check if at least one ALG is enabled\n if (!vuln)\n {\n buf = junos_command_kb_item(cmd:\"show security alg status\");\n if (buf)\n {\n pattern = \":\\s*Enabled$\";\n if (preg(string:buf, pattern:pattern, multiline:TRUE))\n vuln = TRUE;\n override = FALSE;\n }\n }\n\n if (!vuln && !override)\n audit(AUDIT_HOST_NOT,\n 'affected because neither flow-based processing for IPv6 traffic is enabled nor at least one ALG is enabled'); \n}\n\njunos_report(ver:ver, fix:fix, model:model, override:override, severity:SECURITY_HOLE);\n", "title": "Juniper Junos SRX Series ALG 'flowd' Remote DoS (JSA10650)", "type": "nessus", "viewCount": 0}, "differentElements": ["references", "modified", "sourceData"], "edition": 1, "lastseen": "2016-09-26T17:23:47"}], "edition": 3, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "a9dcf995223f353eda7bf326345d8e06"}, {"key": "cvelist", "hash": "5584c5a4c503db60b297fd37753044d2"}, {"key": "cvss", "hash": "737e2591b537c46d1ca7ce6f0cea5cb9"}, {"key": "description", "hash": "fe9fd04e43689fba05b082bfa0306f25"}, {"key": "href", "hash": "b232f0b300d7fd6cb958cccee1d45122"}, {"key": "modified", "hash": "e7c99ea8270f32c4596b63d798cb8592"}, {"key": "naslFamily", "hash": "f44fb98241ad612bdd34e6e796e60393"}, {"key": "pluginID", "hash": "c39a4e269d9c1ed44b4a53c94a95b52b"}, {"key": "published", "hash": "c3560fb562d22673fe089f080adde204"}, {"key": "references", "hash": "0bb4c00b1840cb0366374516988bb9e9"}, {"key": "reporter", "hash": "9cf00d658b687f030ebe173a0528c567"}, {"key": "sourceData", "hash": "b81a08b1524756f5980b0ea90881e5e4"}, {"key": "title", "hash": "1aadf38ba4a2a4de198e02a704ba3377"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "47d67ad848e9e1a8ded237be1d1842e52c695d892637a505ca629d14c3f1e3fc", "viewCount": 0, "enchantments": {"vulnersScore": 5.0}, "objectVersion": "1.3", "sourceData": "#TRUSTED 1298b96d4234724afee29ed720f81707b479bcf6657ab848a5ce453819919100f5b81c65e81aa28a07b33ce4d31548dddf9c7d854466349235855e3460ce4b61ddc38a1be4edaff32ec415e2de40e1332977755329301f49fa57f352ab45d98631db88e675f7f62181349db8d1328799e5a06598a97fe80375f60860fb04c1c60a824c65b5e7dd01bfb094b63936dedc7417990fe23c3a851adddb80c524f1df4d4a34b07d630a0c30a49d1f6121994946a98c658e058ee3d352b439a7cd5cb7db35dd2777e78dd0781ff9d0ae6b1fcbca047e1e2aa6adacca453c5075b434000cfc6dc5cac53b48ddff00b99e06f5166174f7796b70b4a22e0a20bb7fffdaebae9b46c3d4c9fa4320139a4688f0570bcb4821f68e9543464b58608675959ea71b9d8ced4baccbf17e0cfaded02d78c405a9c7874b7b961f1c8d121f6ac10e03c1057a730f0bd9da9d35897ce9f011fc9de7ec23fc46882b531efb6d10ca40ca92ffbea9264f9e88bc6592ba674a7f5691b6c0db43a26ea5ac9cbe55af424fc1b3ffd552e8f7681b71190cf712483e5ea402eb9d30f491639142c1153a79fa635f8946fb9e6ec13b1c2a62e4af97c5ce8013eec02ba66d3fa58feb2217bfe28666a6eb897545cb23b3df58800f2bd543391326f2e3917d51930a5b2d4166f289efb90b014528f6e52291cabb30fc6aa50837db183c8375fb06c855a61f4f8c68\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(78421);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2017/05/16\");\n\n script_cve_id(\"CVE-2014-3825\");\n script_bugtraq_id(70366);\n script_osvdb_id(113076);\n script_xref(name:\"JSA\", value:\"JSA10650\");\n\n script_name(english:\"Juniper Junos SRX Series ALG 'flowd' Remote DoS (JSA10650)\");\n script_summary(english:\"Checks the Junos version, model, and configuration.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote device is missing a vendor-supplied security patch.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its self-reported version number, the remote Juniper\nJunos SRX series device is affected by a denial of service\nvulnerability related to ALG (Application Layer Gateway). A remote\nattacker can exploit this issue by sending a specially crafted SIP\npacket to an SRX series device, resulting in a crash of the 'flowd'\nprocess. Repeated exploitation may result in the device becoming\nunresponsive.\n\nNote that this issue only affects devices with any ALGs enabled or if\nflow-based processing for IPv6 traffic is enabled. All SRX devices,\nexcept for SRX-HE devices, have the SIP ALG enabled by default.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10650\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply the relevant Junos software release or workaround referenced in\nJuniper advisory JSA10650.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/10/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/10/14\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"combined\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:juniper:junos\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Junos Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2017 Tenable Network Security, Inc.\");\n\n script_dependencies(\"junos_version.nasl\");\n script_require_keys(\"Host/Juniper/model\", \"Host/Juniper/JUNOS/Version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"junos_kb_cmd_func.inc\");\ninclude(\"misc_func.inc\");\n\nver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');\nmodel = get_kb_item_or_exit('Host/Juniper/model');\n\ncheck_model(model:model, flags:SRX_SERIES, exit_on_fail:TRUE);\n\nfixes = make_array();\nfixes['11.4'] = '11.4R12-S4';\nfixes['12.1X44'] = '12.1X44-D40';\nfixes['12.1X45'] = '12.1X45-D30';\nfixes['12.1X46'] = '12.1X46-D25';\nfixes['12.1X47'] = '12.1X47-D10';\n\nfix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE);\noverride = TRUE;\n\n# Check if either configurations are enabled \nif (get_kb_item(\"Host/local_checks_enabled\"))\n{\n # Check if flow-based processing for IPv6 traffic is enabled\n vuln = FALSE;\n buf = junos_command_kb_item(cmd:\"show configuration | display set\");\n if (buf)\n {\n pattern = \"^set security forwarding-options family inet6 mode flow-based\";\n if (junos_check_config(buf:buf, pattern:pattern))\n vuln = TRUE;\n override = FALSE;\n }\n\n # Check if at least one ALG is enabled\n if (!vuln)\n {\n buf = junos_command_kb_item(cmd:\"show security alg status\");\n if (buf)\n {\n pattern = \":\\s*Enabled$\";\n if (preg(string:buf, pattern:pattern, multiline:TRUE))\n vuln = TRUE;\n override = FALSE;\n }\n }\n\n if (!vuln && !override)\n audit(AUDIT_HOST_NOT,\n 'affected because neither flow-based processing for IPv6 traffic is enabled nor at least one ALG is enabled'); \n}\n\njunos_report(ver:ver, fix:fix, model:model, override:override, severity:SECURITY_HOLE);\n", "naslFamily": "Junos Local Security Checks", "pluginID": "78421", "cpe": ["cpe:/o:juniper:junos"]}
{"result": {"cve": [{"id": "CVE-2014-3825", "type": "cve", "title": "CVE-2014-3825", "description": "The Juniper SRX Series devices with Junos 11.4 before 11.4R12-S4, 12.1X44 before 12.1X44-D40, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D25, and 12.1X47 before 12.1X47-D10, when an Application Layer Gateway (ALG) is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted packet.", "published": "2014-10-14T10:55:05", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3825", "cvelist": ["CVE-2014-3825"], "lastseen": "2016-09-03T20:31:08"}], "openvas": [{"id": "OPENVAS:1361412562310105930", "type": "openvas", "title": "Junos Flowd Denial of Service Vulnerability", "description": "JunOS is prone to a Denial of Service Vulnerability", "published": "2014-11-20T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310105930", "cvelist": ["CVE-2014-3825"], "lastseen": "2018-04-09T11:12:27"}]}}