Juniper Junos OS Vulnerability (JSA83015)

#TRUSTED 3dc246ca5179cfe416ad9eb5540d43593ff4fe7c717c1ddcbec875dde0d7edc19223b1ec5d467ec3abccd67f9e0467c184d3a89fc19082cc5def8468822f864cfabdb17821721b3c3dee74b9012e44fbbfa5b2d4e2cd5a5d957e828e6ba104c4a5eff9f1ccd3ae040d9e3771cf74e13f51a7bd3a79526d6d05c439af80923a0b207742cf9e36c5ce7f54e68eb2c7c0bf7cbeb253d054084344d99d2c27b320641dfc3fb25d4b90a79c0bf0a83945520201962e503fb79314f19e06935b25e8818fc31e5eecb01297a3b0e0575e4d1a37e2abbe909b1133a54e7b02652a57b0c342c928cb3fe8fde6c32dd0e0d24a5d6e394f0533d1866acff8a49c58bdda1d4246e7430c7fd250cb032073bef8d219e59c80aa424a9b6cedc3703da891870c7877f5c73b9eab202d6bf6728228bc64e94dec92c393c79805e2bc74d3dda5c848dd21fbc3501db4cd39f76169a89bbc05cd1db969fdf4512f158584e254b0198867fcba7bc33d56fc5024db566f7619f3c55f4e5f90cdd81f4da6afbefe36c552370bdff1af9a9ca1209b4754b09aedf32af293c3b0c994736b6868a46b63459f395bb922908ae0853a08e45ecacf1977e0a09b48f3fb20c7a5dc6d04024dbc9538f4051c9367b569a8f50383702397e23851b7283ce8fe3728c4c69237c308c061f6e008e99e9c2e0f346d937675dd6ad8881faffec695678a8f4d7324cae33e
#TRUST-RSA-SHA256 6b52a33c1ce07433c8e9f59f34359388f061b8519349dd51d4fdb7e87d528d4f315c4e8db67a6a5cc33eeb3649738cc3ac839a2bfbf2d30b6feb50e1ed76dfba71b5c60c5ff91425aeb33c301b3fd00a9327d0ca163284cc4f881023b9019d13b0f285a88028d5d733f47b3924de3824526153cc1bab81c4dc66dad632a6d5e94ed5b9955e6516cd834fafdbc0cb6bc5523454c21b89ad0fdfcacf104baafb59be37317e3578316b798e00fc16893e31869d9bbc012ddbb98a3499c15d8736fdc00f63e06eb80edbf370c2058c4f20b8321a4d2c49c3a5408fcecc3f168040caddf24d8eea5e3bbda3027b2e09dc79fedd8b4ac82e25c7baf65a3dc6b41a0666d2587337a014ae5911c349801fe3b1e3d0948f1b8e613833d4acf490f430a11f98d1445bb1d134004ba1e9c2b2435b66105f84bb3fa368404996d81802de06e29e2747fe1cd727321adb60d278663dbaad8f9ad7ee791525773141ba4a8154c3d4f6f7346bd6b8a57ed706c8fc564a63eb482803cce948454b695f7b3bc40c19b4d7cfb37af5f5ba251ab63f80e0ad360307e2ec673a0cff32770f1abf0994aa48e0ce10749d4884d487cc040c68d4fc80de954d0fbb6ed1a184c79bbb9a0b1780786138bf369e3e2a68f0bd2cd8f126760a6a81c51328d9175b67802e5e06d331c6d9f221bfdd8a16e62b8171041cc63cde9e2126c5f78d24181c898d52eba8
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
# This file was created in whole or in part by AI.
##

include('compat.inc');

if (description)
{
  script_id(310761);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/28");

  script_cve_id("CVE-2024-39555");
  script_xref(name:"JSA", value:"JSA83015");

  script_name(english:"Juniper Junos OS Vulnerability (JSA83015)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA83015
advisory.

  - An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (RPD) of
    Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specific malformed BGP update
    message to cause the session to reset, resulting in a Denial of Service (DoS). Continued receipt and
    processing of these malformed BGP update messages will create a sustained Denial of Service (DoS)
    condition. Upon receipt of a BGP update message over an established BGP session containing a specifically
    malformed tunnel encapsulation attribute, when segment routing is enabled, internal processing of the
    malformed attributes within the update results in improper parsing of remaining attributes, leading to
    session reset: BGP SEND Notification code 3 (Update Message Error) subcode 1 (invalid attribute list) Only
    systems with segment routing enabled are vulnerable to this issue. This issue affects eBGP and iBGP, in
    both IPv4 and IPv6 implementations, and requires a remote attacker to have at least one established BGP
    session. This issue affects: Junos OS: * All versions before 21.4R3-S8, * from 22.2 before 22.2R3-S4, *
    from 22.3 before 22.3R3-S3, * from 22.4 before 22.4R3-S3, * from 23.2 before 23.2R2-S1, * from 23.4 before
    23.4R1-S2, 23.4R2. Junos OS Evolved: * All versions before 21.4R3-S8-EVO, * from 22.2-EVO before
    22.2R3-S4-EVO, * from 22.3-EVO before 22.3R3-S3-EVO, * from 22.4-EVO before 22.4R3-S3-EVO, * from 23.2-EVO
    before 23.2R2-S1-EVO, * from 23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO. (CVE-2024-39555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2024-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-a-specific-malformed-BGP-update-causes-the-session-to-reset-CVE-2024-39555
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3ad29e6c");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA83015");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/R:A");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-39555");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/28");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');


var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'21.4R3-S8'},
  {'min_ver':'0.0-EVO', 'fixed_ver':'21.4R3-S8-EVO'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S4'},
  {'min_ver':'22.2-EVO', 'fixed_ver':'22.2R3-S4-EVO'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R3-S3'},
  {'min_ver':'22.3-EVO', 'fixed_ver':'22.3R3-S3-EVO'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R3-S3'},
  {'min_ver':'22.4-EVO', 'fixed_ver':'22.4R3-S3-EVO'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R2-S1'},
  {'min_ver':'23.2-EVO', 'fixed_ver':'23.2R2-S1-EVO'},
  {'min_ver':'23.4', 'fixed_ver':'23.4R1-S2', 'fixed_display':'23.4R1-S2, 23.4R2'},
  {'min_ver':'23.4-EVO', 'fixed_ver':'23.4R1-S2-EVO', 'fixed_display':'23.4R1-S2-EVO, 23.4R2-EVO'}
];

var override = TRUE;
var buf1 = junos_command_kb_item(cmd:'show configuration | display set');
if (buf1)
{
  var conf1 = !junos_check_config(buf:buf1, pattern:"^set .*protocols bgp group \S+ family inet segment-routing-te");
  var conf2 = !junos_check_config(buf:buf1, pattern:"^set .*protocols bgp group \S+ family inet6 segment-routing-te");
  if (conf1 && conf2)
    audit(AUDIT_OS_CONF_NOT_VULN, 'Junos OS');
  override = FALSE;
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_HOLE);