Juniper Junos rpd BGP add-path DoS (JSA10771)

#TRUSTED 16a5b09e4c491c77102a81b7be53cb7ba6dc1c78913ea2b4c8973915cc486dcf4227363bf2fdf74affad344f4f272d7a31709cd4c28715a5fb5892103e97fcd46d3e203cd2c6678d6c1e3fbfd4b934943155a98fe4ddae72b294c766c3dd8508cbdf9d62e945bae6b35d8a8696b40af588aaf572cc65d45349c841d88d82c0bef730791e94ce01da682589dcb0378f1f561a93960b1efae3cef0f87a65c381d1275e8419022cc3f1b82e9edc03c0e34b515e258bee1450cb3e18f23bacc0ec3b34c1ba06335cdd5a78c8c0b88e8c77fd63031da00a287a1e3e3c0f9ee1ee63ed1c20b537a13c60ac5c2cb7482bc6ad5b1ddad5210acf6b9cffb2907ffd6ae14547d7fbbe834066977d214bbc2226a245b9e4d0535a4245fb6cd4f655ff5058a9953656ead506205f111d0a6b4637585192b964fcdcaaae9a5b45d6d2e73700235ce8e0b89724e3d231e2f5f90b9ae6fac4ed34c4497b701f2bca26ac701aaf57c9686bdc2e4052e120d77b9d82100f0f3949ab9c5c34b59c2efea8325a02869c9ecdb9b369e24312c746ba57d982dd2b89e73f9d9330f92db2e84ca9e339bb7588db3e7c866a3ed2faa09198bd217c163685249b827ede98e60e73765175d35d88041118a8c2a5807957c6184c3460d422fa0fba7c7795b059aac40be905e51f6191432c9551cc6a3a44444b0ef6cabda53e8dcb0130bc4ec6fbe3da0deb2e2a
#TRUST-RSA-SHA256 1b8f67442493d00736171b8b8b18e3a6ef9d0be06625189bbd060ffb12dd33e93ff79353d02c946255b656d4bd24557d1c03959bc9823227ecf28979e5ea327a482849b4b202e1da7ca0bdc078437972e4e12604ed28835b0801cf6128164c5bfafd11628569d035bfa8bd25988a6edce9b0e2894230a5a795115cd984c33be4befb17ed29aebe1a00b41338a4c24b947edef703df4f6d3eb9efe3bac22fbfe4aa3064d5d8b5a103e3c207bcb43df7abebee5ea11531d570c0afa5c69456a3418050b90830239b580c44e68ceb6d9ad50cb807cddde2b8150800985a44a9f22fb7e55b47e0a2cd6fcab1701bfed7abc276a68905ea59b7416ea1d82d1e37f30c9468b668b73a1cd4b5936767c0d58ea240d1d043564ee9285e5897ab99419ec0fb9f5f5a9d3af8bc1d5339531480669048bb9a425a748143f52fa06d9406700d79ce9a027cd4824d178fcbcf60095eb2da18ca28aa21d046c2971457af1216a523f3a1ac2b329929efe82562de4066f15f5145926307253ae450b7bdd94ea62f932afe70e040f892807c75f742f33710435d32068a7da4e6ac1c9ef19352909f604bfe4855e58ce1d69104c9681cef376695558b2c38772d74d296858e604e44b08f010d72d9ea21285be8adac711d524b42b48cbba739440a7a603a5183fa898b81057e1d49b87a9364e43455b18c5a8231fd2e2a737eaa31edea62e4b3b9f8
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(96660);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/05");

  script_cve_id("CVE-2017-2302");
  script_bugtraq_id(95394);
  script_xref(name:"JSA", value:"JSA10771");

  script_name(english:"Juniper Junos rpd BGP add-path DoS (JSA10771)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number and configuration, the
remote Juniper Junos device is affected by a denial of service
vulnerability in the routing process daemon (rpd) due to improper
handling of BGP packets. An unauthenticated, remote attacker can
exploit this issue, by sending specially crafted BGP packets, to
cause the rdp daemon to crash and restart.

Note that this vulnerability only affects devices configured with the
BGP add-path feature enabled with the 'send' option or with both the
'send' and 'receive' options.

Nessus has not tested for this issue but has instead relied only on
the device's self-reported version and current configuration.");
  script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10771");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release or workaround referenced in
Juniper advisory JSA10771.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-2302");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/01/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/01/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2017-2026 Tenable Network Security, Inc.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include("audit.inc");
include("junos_kb_cmd_func.inc");
include("misc_func.inc");

ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');
fixes = make_array();

fixes['12.1X46'] = '12.1X46-D55';
fixes['12.1X47'] = '12.1X47-D45';
fixes['12.3']    = '12.3R13';
fixes['12.3X48'] = '12.3X48-D35';
fixes['13.3']    = '13.3R10';
fixes['14.1']    = '14.1R8';
fixes['14.1X53'] = '14.1X53-D40';
fixes['14.1X55'] = '14.1X55-D35';
fixes['14.2']    = '14.2R6';
fixes['15.1F']   = '15.1F2';
fixes['15.1X49'] = '15.1X49-D20';

fix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE);

override = TRUE;
buf = junos_command_kb_item(cmd:"show configuration | display set");
if (buf)
{
  lines = split(buf, sep:'\n', keep:FALSE);
 
  # Parse BGP groups that have 'add-path' feature is enabled with 'send' option 
  pattern = "^set.* protocols bgp group (\S+) .* add-path.* send";
  groups  = make_list();   

  foreach line (lines)
  {
    matches = pregmatch(string:line, pattern:pattern);
    if (matches)
    {
      if (junos_check_config(buf:buf, pattern:matches[0]))
        groups = make_list(groups, matches[1]);
    }
  }
  if (empty(groups))
    audit(AUDIT_HOST_NOT, "affected because the BGP 'add-path' feature is not enabled with the 'send' option");

  # Parse local_address from parsed BGP group
  local_addresses = make_list();
  foreach line (lines)
  {
    foreach group (list_uniq(groups)) 
    {
      pattern = "^set.* protocols bgp group " + group + " local-address (\S+)"; 
      if (junos_check_config(buf:buf, pattern:pattern))
      {
        matches = pregmatch(string:line, pattern:pattern);
        if (matches)
          local_addresses = make_list(local_addresses, matches[1]);
      }  
    }
  }
  if (empty(local_addresses))
    audit(AUDIT_HOST_NOT, "affected because no interface with BGP has the 'add-path' feature with the 'send' option enabled");

  # Check if parsed interfaces have the vulnerable BGP configuration
  foreach local_address (list_uniq(local_addresses))
  {
    pattern = "^set interfaces .* address " + local_address;
    if (junos_check_config(buf:buf, pattern:pattern))
    {
      override = FALSE;
      break;
    }
  }
  if (override)
    audit(AUDIT_HOST_NOT, "affected because no interface with BGP has the 'add-path' feature with the 'send' option enabled");
}

junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_HOLE);