Juniper Junos OS Vulnerability (JSA107822)

#TRUSTED 821da85a3b60f13a35eeac8be8f6caecea12ad1760dc51ae532485f0346e52dccb43dbf27352cc23176d351eba052edbf1203d73dfb8bf36592f17e2cef7f4812c38d86ecd77f007ee499ff0362201da8b4b5a6069c85f88eebb7863719fd7d7e2276e8b246c711d3f415b5771d49c45b133a97fb857bf85085ea13a9b44b02581b886bcb94d103b4e8300d3e46c949cf6570c6b92d390dd44262177048bd4180da716d2fc425380b2ed2270bdfe2e8c432bf18aec0ae60bce1af2918a76dec9095cc1b12e39d54360e8ae19a2c063f3333cd61092ac8765d1f0340e7d5fd9bcecfeb9f68d96aaf3848b91d9336eba52e525a9875fe62424741b1b93caf452f7eedd08bb591f656f51712cbfc188fb6468c7217cf0498eca4dec0d84f3327d07c2aad57411ee2f44252d687eca20025de4f5f194ef312de15d354a5a5dd7a2835c0f37d407b6043d5b74cdbc4881eebb7b73a278214a58be4aa34eeb55e9705408ad2996fb5eeda415253533c363e84c0ffece34b86a7a87cdc18d20700df2425916ef2540018053defcbdcfa286ecf83f7ab41e6cc01f00762f49c47a7377cf13dc75298addba7133f6c1ef04e8672891552b6700a10225f48b434b6bbf5d0d3266dd789de5ba155f54c4ab59bb8be6d33c02c7e85b8bff1565139db3a65aa22a63b618ff2e66cd28c54f55b472ce00ccacfc762bb6d4d9d998371768c9edd7
#TRUST-RSA-SHA256 0f00031c00955a27ebcdb65e12b5d296b654b42f28543ea2c6659ec65d6e2eb738aa9d9aecaf4e93c2fbd7b1436dad0056dce524d0d92c78d2552c7e39c4492ca11deaabdc455bc4bac91a99af29c07627fb1385b3e411a77a8a675db36e9590c50a800f453667514740e19a6c3afd8bfc1f4c5113cf4c0f907e6eea8f9037e3ffbe88bd225de63f93be75df74ae8b2027475a7939011b23dd8755b2f3b0b1be2ddfc12cdfb3dd7de874955ad522172730eee03885111ef723f6acba0823a21ddf985fd13bd6f6582cbd46fc3b35f129fbbfa9045a9f76c7f10e9fb2779c32dee5add0c4c7963a26393aca07ba658e161c2492a7784c24ff2daa9ecd3edfac83c75c2eb9f5d5692b86fc5fe1c295b7ed46065655e0694d97728c02066711de1f52ab8746634b9b842dcef220a0ad95b4ecdcae4358fd18c2c2e798487399f6257ed5a97799b62c521698db4839cbd6f7940297da6110a1e7f80175fd052be2003fd9693f38949b3d4d2f68a45f599938ded5f337d3a04ec57123440d2fe8169205e78acfe137468dc82fc0a23b3fcc3730f79ec3b88cff22a60181b487d90fb2e8556c132e01aeedbee6c25aaf7d9800a8afc4ad6a5fdba045afd193b9f0951c7a1c60564235a24c6ecff536d60667632abdde0dea9833dd44da2dc1369aad13a744c077b5f0c5b8f232ae86975914441b7611c7db3d3b766f9b90c597a5c871
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
# This file was created in whole or in part by AI.
##

include('compat.inc');

if (description)
{
  script_id(305589);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/08");

  script_cve_id("CVE-2022-24805");
  script_xref(name:"JSA", value:"JSA107822");

  script_name(english:"Juniper Junos OS Vulnerability (JSA107822)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA107822
advisory.

  - net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version
    5.9.2, a buffer overflow in the handling of the `INDEX` of `NET-SNMP-VACM-MIB` can cause an out-of-bounds
    memory access. A user with read-only credentials can exploit the issue. Version 5.9.2 contains a patch.
    Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or
    SNMPv2c should use a complex community string and enhance the protection by restricting access to a given
    IP address range. (CVE-2022-24805)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2026-04-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-CVE-2022-24805-resolved-in-net-SNMP
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?53c11c50");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA107822");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-24805");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/08/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/08");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');


var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'23.4', 'fixed_ver':'23.4R2-S7'},
  {'min_ver':'23.4-EVO', 'fixed_ver':'23.4R2-S8-EVO'},
  {'min_ver':'24.2', 'fixed_ver':'24.2R2-S4'},
  {'min_ver':'24.2-EVO', 'fixed_ver':'24.2R2-S4-EVO'},
  {'min_ver':'24.4', 'fixed_ver':'24.4R2-S3'},
  {'min_ver':'24.4-EVO', 'fixed_ver':'24.4R2-S3-EVO'},
  {'min_ver':'25.2', 'fixed_ver':'25.2R1-S2', 'fixed_display':'25.2R1-S2, 25.2R2'},
  {'min_ver':'25.2-EVO', 'fixed_ver':'25.2R1-S2-EVO', 'fixed_display':'25.2R1-S2-EVO, 25.2R2-EVO'}
];

var override = TRUE;
var buf1 = junos_command_kb_item(cmd:'show configuration | display set');
if (buf1)
{
  var conf1 = !junos_check_config(buf:buf1, pattern:"^set .*snmp");
  if (conf1)
    audit(AUDIT_OS_CONF_NOT_VULN, 'Junos OS');
  override = FALSE;
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_HOLE);