Juniper Junos OS Vulnerability (JSA112177)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(365669);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/14");

  script_cve_id("CVE-2026-102081");
  script_xref(name:"JSA", value:"JSA112177");

  script_name(english:"Juniper Junos OS Vulnerability (JSA112177)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA112177
advisory.

  - A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (PFE)
    of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a
    complete Denial-of-Service (DoS). On SRX4000 Series, and SRX5000 Series with SPC3, and MX Series with
    SPC3, when one or more specific application services like ALGs, IDP/DPI, APPID, SECINTEL, AAMW or AppQoE
    are configured, a high connections per second churn will cause PFE memory to leak. If the memory is
    exhausted traffic processing will be impacted. Use the CLI command show security monitoring to monitor the
    memory utilization of the PFEs on the FPCs. This issue affects Junos OS on SRX Series and MX Series: *
    23.4 versions from 23.4R2-S3 before 23.4R2-S7; * 24.2 versions from 24.2R2 before 24.2R2-S3; * 24.4
    versions before 24.4R2-S3; * 25.2 versions before 25.2R1-S2, 25.2R2. (CVE-2026-102081)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2026-10-Security-Bulletin-Junos-OS-SRX-4000-Series-SRX5000-Series-with-SPC3-With-application-services-configured-high-session-churn-causes-memory-leak-which-will-ultimately-impact-traffic-CVE-2026-102081
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6d56b19a");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA112177");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/AU:Y/R:U/RE:M");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-102081");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/14");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version", "Host/Juniper/model");

  exit(0);
}

include('junos.inc');

var model = get_kb_item_or_exit('Host/Juniper/model');
if (model !~ "^(4000|5000|MX|S|SRX)")
{
  audit(AUDIT_DEVICE_NOT_VULN, model);
}

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'23.4R2-S3', 'fixed_ver':'23.4R2-S7', 'model':'^(4000|5000|MX|S|SRX)'},
  {'min_ver':'24.2R2', 'fixed_ver':'24.2R2-S3', 'model':'^(4000|5000|MX|S|SRX)'},
  {'min_ver':'24.4', 'fixed_ver':'24.4R2-S3', 'model':'^(4000|5000|MX|S|SRX)'},
  {'min_ver':'25.2', 'fixed_ver':'25.2R1-S2', 'model':'^(4000|5000|MX|S|SRX)', 'fixed_display':'25.2R1-S2, 25.2R2'}
];

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
var report = get_report(ver:ver, fix:fix);
security_report_v4(severity:SECURITY_HOLE, port:0, extra:report);