Juniper Junos DoS Telnet Vulnerability (JSA10817)

#TRUSTED 8e77db89e8ddc76cb9ea3ae6801f32f516c33e2aea5f08b0818086071f3fe9d0c8973a047d7eaf22b70b15aa2a536f6b7f0a2e678dfcf9d9f6cf8de9d0a2c1b8f3d8f56eb40f052d182e5dec9dbc1ea94f4542550e41849cae1a1a8f18468712dffa4392a52774a82b36f1176f66ae8fe39ad02cc9f1297f917c59d66a4b85aad85bb8d9e397ad324e8f2ace6934e2dd56b6590fc987e456ad6c82b2eaffdd1106c88be42b8874ef383e9b6152790993dd90a94c9481ccc10e5764df80f4975e1de79c9a0a9999d8ca7760bd672a894063d37d184a71e9c62308a2b6b68b13762fd368b1a95f1afc50eec080ed655593ab358dbd827200f1d870ce13754be44341078934d01ccd2c3a5902a23a505f93aa0a96ce847414d28721413a214f0bdf8e2f757c6c32b05b4cdf1f089d5773a8501a0977e6f05570ea78af7ca4ef6805b0418f3b38d5af1d11ee944ef9ae2d387fefd61915fae095f91ed4d35daf66fbd3ae4173a2f1b7935b127d41e91c36982a6732b36192665fe1aad9d5a1780a23cda74be420a0bb1954e909470f52bf8e35d060a7e9ceacd91bd15612c8d5b50ac22ca713a8cd8056319cab0f2642720d1fe52feafcc4265c9f5f9c461e6caf267ec9485f04b4baf5e9786839e045551afb06f5eeb680bb9a998fa2f5550d8bd909db42a3d705f7a438c3efd9bb2349182bd4e040b3bc8cf7e274d82e79e8e197
#TRUST-RSA-SHA256 3fb20c41ee8ab89ebebe5fb9731620e95e1c05c24b0b072ce282a039985264cdf5c482604610f092dab458fb23145bf1156fe06e2726fa6493f497c44622ae802f788ed707754aeadf52c6582327f475e714aecec44165cb09c392e51807be64a1d97893a9d84c0019d5e5c047d51ff3b67b018d5199a4f537a7392a8cb752133d3bba43b9e4034eced54ab956015ec3db83773e6255c1dcec85c81988039caf83f58b5641a2407f5510d0dbcbfa05c63d4ea994243907509080594d84f17ee50565ca6f736caadfe01536be11e0e693abf61dea10205fc4e25d9e75fba0e58c965abd744ff9235202074bbdc4508f56514b2085bf6bd83906265e8c4090edd900b105ff414358e0411cbdfa98625c7881afd4c0c6269021693b48f03e2b4bf9dfd3726d8eaf65b747dbaad4028d3c851a42ea317eeebb4d310ea368e9543dec6f00c64eec051e33ca3a69d784cec597fdd96da7de1df60dca8bdbdf683b8912e03d005dcfd806e2902d8cf77abd6fde1eedba9b325c82d2f5dad475087ca4cf0f59067cf49d3e83eb4e05f8af8736678b17b8317fb680384bd85ce27a09253729d80ccae4c6f299d54be07e1466edec086d3eee71aa742d65ac28c0d5fc3d3abf951d1a95cdbb1bc805e300891b94b5838d3874503083ae94e66afc36d8681a338e7df8ecc699bfb200dfcf924433f7627c993aad992dc47efa54f21915cdfd
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(104037);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/18");

  script_cve_id("CVE-2017-10614", "CVE-2017-10621");
  script_xref(name:"JSA", value:"JSA10816");

  script_name(english:"Juniper Junos DoS Telnet Vulnerability (JSA10817)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the remote Junos device
is affected by two vulnerabilities in the telnetd service that 
may allow a remote unauthenticated attacker to cause a denial of service 
through memory and/or CPU consumption.");
  # https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10817&actp=METADATA
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0d927783");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release or workarounds referenced in
Juniper advisory JSA10817.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-10621");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2017-10614");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/10/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/10/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/10/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2017-2025 Tenable Network Security, Inc.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include("audit.inc");
include("junos_kb_cmd_func.inc");

ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');


# Affected:
# 12.1X46 prior to 12.1X46-D71
# 12.3X48 prior to 12.3X48-D50
# 14.1 prior to 14.1R8-S5 or 14.1R9
# 14.1X53 prior to 14.1X53-D46
# 14.2 prior to 14.2R4-S9 or 14.2R7-S8 or 14.2R8
# 15.1 prior to 15.1F5-S6 or 15.1F6
# 15.1X49 prior to 15.1X49-D90
# 15.1X53 prior to 15.1X53-D47
# 16.1 prior to 16.1R4-S1 or 16.1R5
# 16.2 prior to 16.2R1-S3 or 16.2R2
# 17.1 prior to 17.1R1
fixes = make_array();
fixes['12.1X46']     = '12.1X46-D71';
fixes['12.3X48']     = '12.3X48-D50';
fixes['14.1']        = '14.1R8-S5';
fixes['14.1X53']     = '14.1X53-D46';
fixes['14.2']        = '14.2R4-S9';
fixes['15.1X49']     = '15.1X49-D60';
fixes['15.1X53']     = '15.1X53-D47';
fixes['15.1R']       = '15.1R5-S2';
fixes['15.1X49']     = '15.1X49-D90';
fixes['15.1X53']     = '15.1X53-D47';
fixes['16.1']        = '16.1R4-S1';
fixes['16.2']        = '16.2R1-S3';
fixes['17.1']        = '17.1R1';

if (ver =~ "^15\.1F[0-2]")  fixes['15.1F'] = '15.1F2-S16';
else if (ver =~ "^15\.1F5") fixes['15.1F'] = '15.1F5-S7';
else if (ver =~ "^15\.1F6") fixes['15.1F'] = '15.1F6-S6';

fix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE);

override = TRUE;
buf = junos_command_kb_item(cmd:"show configuration | display set");
if (buf)
{
  pattern = "^set system services telnet";
  if (!junos_check_config(buf:buf, pattern:pattern)){
    audit(AUDIT_HOST_NOT, 'affected because telnet is not enabled');
  }
  override = FALSE;
}
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_WARNING);