Juniper Junos OS Vulnerability (JSA73150)

#TRUSTED 9120fb460acf50d3003ddaceb98cffadff553e7c16ee19b0c3b079c7aa700698d2bf1a5b50811860df98c523537612e66ba551d411fe4422aa0b5fc65243b5fa1c34623273c429d291ae58a0df2469dcafd0006d3ecaabfff45a57e4d147a6a3fc0a1663ec877348239cc7ca13bc3e3cbffd876f743526aa7ad95a60420a5d796f8d9e0437ee5e9713e35cb55bb082230f65083b9e5df6d40436671a3597a96bbbedcd4545764317f822490ca3ffcb040088b71ec16be8c8f0f83bcbefc8aa4404fa8ba5748315692fdce3cc7bdadec3085bd11a99fb38a826aa1cd350e9f43d2d1fe4708d90277a1cb2cd9d77d07d484011c7aae416565afd49d2582857c3d403956c72c832c4a07cbdece194d78558a187922f347f3a8abf7256201e33f199f007e6d92d2f7f68a34418c527827d8edb7e0f30ac504ecd5a4617a462b27cc239594bdc9e664733bc8da12f45db8c780b3574c473e6b35061b2dcae3b4e8b95950218d323412f38e40d5d27fc98f68759db0412c3213b15865b783c3f38477c91f6a41cbce895dfbdb2b0cc364c21f6db38800eab5b1ace3565af862d3f0432dbc3453e53661adc76471b3f394ba0c4aab49ba2cc447417f839fe99b6fab9e177e268e0270e82f07854cb846ba1759fe7cfc02136c76e8a90bec74413dc84248837023c1a29b6dcb9f1db13a0a79554c9fb15a6c821ddd341084954e52c0c7a
#TRUST-RSA-SHA256 3251359e74056edf292a184e99f045a37be0c9b08bd75e509065c6e3ff085c53cf59a9f99851d3de2c02ed3ade25883fa7342f853c473a4f57fd10332f7a2efb564cb2bed7c8602ffb1c7ca3c366b85faae69c88c8ad87beb797f5af2d492322197ff8cf8f2b68fbc8c59a636dc1f64d742569f33c200fe2f19cdb01df6a97ec169fe4717247f1a88269b08586cb0bc23e00b7062967f168cef5ef1cea08bb4b2823091f01d2765aaca19d81a45477098ed9b9c2a9f72cebba47d8ffe5984cc087b816cf7f24859c931eb3375d650963022ce00885ac8f09cf1cfe4d306dc139c522cdb3f438f12ad9790b5474c7ae38c9cf41f133973e72ed15bbdaec022baafe12357b732492f54e91937607f2b221ab71b16e89506a8b8adcc47f50c45a3506a7eb93b738f2319984ef082d0f042776a8a4f7d97f1580649d66450989ed418d4e38c7183f28ac8d48cc2efe4d84ae4bc9272935db254120ba444a022b66c1e69c419b8c37ef9fb9f2c02daf8440309ba612263aa1acaa95eb2517d4b664deb1239bb7827e8699b0dcf9f00b65dd9a64a385aecd1ab69827d2ce4a6b2713dd02cd6ad0e4022449d93c04b8086f0e9a2fb5ad3d1f3b9c554a20eea37a50893482b922084c691890c4adcbd83e66aab419266a275dbb31514612969037d5099b909649623cd5e0626fc3d7755f9c6036c227c9442514158eaae904b3d52922c5
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(183504);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/10/23");

  script_cve_id("CVE-2023-44186");
  script_xref(name:"JSA", value:"JSA73150");
  script_xref(name:"IAVA", value:"2023-A-0565");

  script_name(english:"Juniper Junos OS Vulnerability (JSA73150)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA73150
advisory.

  - An Improper Handling of Exceptional Conditions vulnerability in AS PATH processing of Juniper Networks
    Junos OS and Junos OS Evolved allows an attacker to send a BGP update message with an AS PATH containing a
    large number of 4-byte ASes, leading to a Denial of Service (DoS). Continued receipt and processing of
    these BGP updates will create a sustained Denial of Service (DoS) condition. This issue is hit when the
    router has Non-Stop Routing (NSR) enabled, has a non-4-byte-AS capable BGP neighbor, receives a BGP update
    message with a prefix that includes a long AS PATH containing large number of 4-byte ASes, and has to
    advertise the prefix towards the non-4-byte-AS capable BGP neighbor. (CVE-2023-44186)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://supportportal.juniper.net/JSA73150");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA73150");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-44186");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/10/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/10/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/10/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');


var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'20.4R3-S8'},
  {'min_ver':'0.0', 'fixed_ver':'20.4R3-S8-EVO'},
  {'min_ver':'21.1', 'fixed_ver':'21.1R1'},
  {'min_ver':'21.1', 'fixed_ver':'21.1R1-EVO'},
  {'min_ver':'21.2', 'fixed_ver':'21.2R3-S6'},
  {'min_ver':'21.2', 'fixed_ver':'21.2R3-S6-EVO'},
  {'min_ver':'21.3', 'fixed_ver':'21.3R3-S5'},
  {'min_ver':'21.3', 'fixed_ver':'21.3R3-S5-EVO'},
  {'min_ver':'21.4', 'fixed_ver':'21.4R3-S5'},
  {'min_ver':'21.4', 'fixed_ver':'21.4R3-S5-EVO'},
  {'min_ver':'22.1', 'fixed_ver':'22.1R3-S4'},
  {'min_ver':'22.1', 'fixed_ver':'22.1R3-S4-EVO'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S2'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S2-EVO'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R2-S2'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R2-S2-EVO'},
  {'min_ver':'22.3R3', 'fixed_ver':'22.3R3-S1'},
  {'min_ver':'22.3R3', 'fixed_ver':'22.3R3-S1-EVO'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R2-S1', 'fixed_display':'22.4R2-S1, 22.4R3'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R2-S1-EVO'},
  {'min_ver':'22.4R3', 'fixed_ver':'22.4R3-EVO'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R2'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R2-EVO'}
];

var override = TRUE;
var buf = junos_command_kb_item(cmd:'show configuration | display set');
if (buf)
{
  override = FALSE;
  if (!preg(string:buf, pattern:"^set chassis redundancy graceful-switchover", multiline:TRUE))
    audit(AUDIT_HOST_NOT, 'affected because the Graceful Routing Engine Switchover (GRES) feature is not enabled');
  if (!preg(string:buf, pattern:"^set routing-options nonstop-routing", multiline:TRUE))
    audit(AUDIT_HOST_NOT, 'affected because the Nonstop Active Routing (NSR) feature is not enabled');
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_HOLE);