Juniper Junos Routing Process Daemon BGP UPDATE DoS (JSA10778)

#TRUSTED 46d14b73d771ed4e59b8366f8fcfa8fad4ee1a460ba0ce4929482c68ae54342aa6883ae757fd6fbefd4d0ca2c0729af3dd7c8a6238cae291b6574d18e1e2e9f1b115434bfcad8639ba35a6db9df32a4ddef6a6dc35004454fdbcfc7fdd65c5f7fd26723bd28b0fa25f9266743069bedccab70257e68e75e0e9335a84e27242ddf5eebedd6dd15babea35d53094e48af970e4b710ca032f55efab78579c52af25a2d14973165a87fc80512b4f25f2f404cc0a2f04a9c27dcc2a0a3f5945c969f3eb363ba998b543a18ee5f39028c19f605b179937d04f5b8ff870c9065fe70a4b551def89e2de87b01cd134940e843ef7bbc06f52c68c038511efff8706a3a2ea4a6026051a92943fe8e492b5149fac45c110ac61999a020b77b3314a342094fcec6e8b6efbd499d916bc7d76f34c91e8318225b988263798a48f11878167750fc5583de70b0fd6a764269fd42df0571df000a538de15238a1a711e481545c00ddc268b86e289d924969635c36203b7b555a2c92e4932cee9f5354a5e14c113211566caeb3702d68bcaa734e7e4513887d2c642b3ef9acc051890e285960cc5545c4cb8f10b5f2f82331099fda1cc587cf38b1792dde570378e08a2e66f7259fef77b0220b7fb6b5f02b630a464bb8af7f20a72494726539fe7eb1e135f6142b051558539434a7cb8cef4be3739dc8ac07d14aef4b83510d536046a5926daeca4
#TRUST-RSA-SHA256 096b4d37339c02f9a7bcbb8000f878f8d0ab73082df37f2e28414cf9d4d7e273b13532cebfd6f42b25a6b12567d3d1de462e06ade777c6247e29dbabe69060316294a7f1f286c7961686b8da56ad657293e5362b861b4dc7eb02dc4218408f3fded5aa17065bd077aec0900927225cfe9b09ce51cfd007f37fcde3671e149efb162af7ac47a7abf0d03093cfdd52f9eabf5861ba15994c4834b89ff8f123931ac6630957ecc6074f50768aefa285c1bd91ec95182e7c6f2dcc09a1c3dfdefdecf31e368e38321484a60b4333760911da32099e43420ad9c5c90167b089c2e0df3245d5265c66c2fbf6e3b18a8f7037403a8fb3da2ee1f10d99aa9f2d65e792e86e3e4d0d93b5c5c3bcf96556ccbd7994f5e79c3ca029037c282e4befb6bb71859ed693fbe8d5d5ab6cbbc724a78d322766fa3229fe942dd61c70f0970d17723ebde5cba45d5ec8c4737868943c1f8cd59505699e1088b127446ff46ab68aa9ea325908834ed1b6400397820c6f5e87105da30d43a77fe2741d91f960c11f10f700e513a18718313135f80a568d721725ffb81c4deb85f09ae05d08e8af24889a799171a4af861b5a3b2d7671beeed133a286e885d1f823ced383abf6e49a56996bf1d69370fdc347e7f53d9eedabfbc1dfcaecf19ae3de8b7615061b074ca0c806d27f5f8da71119e222f63a35a89338047590a35acfa5881de225410ea1f6dc
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(99525);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/25");

  script_cve_id("CVE-2017-2313");
  script_bugtraq_id(97606);
  script_xref(name:"JSA", value:"JSA10778");

  script_name(english:"Juniper Junos Routing Process Daemon BGP UPDATE DoS (JSA10778)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version and configuration, the remote
Juniper Junos device is affected by a denial of service vulnerability
in the routing protocol daemon (rpd) when handling a specially crafted
BGP UPDATE. An unauthenticated, remote attacker can exploit this to
repeatedly crash and restart the rpd daemon.

Nessus has not tested for this issue but has instead relied only on
the device's self-reported version and current configuration.");
  # https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10778&actp=METADATA
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?910a6d37");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release or workaround referenced in
Juniper advisory JSA10778.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-2313");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/04/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2017-2025 Tenable Network Security, Inc.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version", "Settings/ParanoidReport");

  exit(0);
}

include("audit.inc");
include("junos_kb_cmd_func.inc");
include("misc_func.inc");

ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');
# Commands ran may not be available on all models
if (report_paranoia < 2) audit(AUDIT_PARANOID);

fixes = make_array();

fixes['15.1F2'] = '15.1F2-S15';
fixes['15.1F5'] = '15.1F5-S7';
fixes['15.1F6'] = '15.1F6-S5';
fixes['15.1F'] = '15.1F7';
fixes['15.1R4'] = '15.1R4-S7';
fixes['15.1R5'] = '15.1R5-S2';
fixes['15.1R'] = '15.1R6';
fixes['15.1X49'] = '15.1X49-D78'; # or 15.1X49-D80
fixes['15.1X53'] = '15.1X53-D63'; # or 15.1X53-D70 or 15.1X53-D230
fixes['16.1R3'] = '16.1R3-S3';
fixes['16.1'] = '16.1R4';
fixes['16.2R1'] = '16.2R1-S3';
fixes['16.2'] = '16.2R2';
fixes['17.1'] = '17.1R1';
fixes['17.2'] = '17.2R1';

fix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE);

override = TRUE;
buf = junos_command_kb_item(cmd:"show bgp neighbor");
if (buf)
{
  if (preg(string:buf, pattern:"BGP.* instance is not running", icase:TRUE, multiline:TRUE))
    audit(AUDIT_HOST_NOT, "affected because BGP is not enabled"); 
  else
    override = FALSE;
}

junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_WARNING);