Juniper Junos OS Vulnerability (JSA83018)

#TRUSTED 02c645aea2ef0e301fd0213dbbf691aded3576c98d14e81ee0a1bbd7155889a46814cb474c2ddc2453a601dd03a210c4b9a9b4963b3cc7803610a0358bd871cd5d081c0f4b0a712b425e512a703648906c7bc078e9cf10a7780cc8d7729a90a83c1acd9931175577d494c0d36abc5bae2d5c5d2469a75c012587be2119e2472810c79c9b4f90cc60f4ac40e7cd7a2f3d4a79f34162200ecdb80359429b825fc214375ed97709730c188f6f6383760e90069ff17f6f27fbad44296b493fcd60fa46fc59fcb31c227ed52cba6d53ebc206e610a7578456a697fc788e52f683e45f7da57139e4f2240e13ee731f1ea8ce710078247c1e23a1d250aabcb7a56db5e101de98d9fafd2942999fc6fbd9d3bc15f4a63ad7a06c840a6909cae6611e2806bd8ea4f6656764408b02c6c3d92fef1bc4453d89d8386c832cac0437317282e852ef17cf490167e158c628d073cba51703362ab6357d9dff61b69348e6c089909987bb7d4a47ec361a871be0ade0594bfe6d437b26d67d3ff1ee56da2054f1e53d7693e3c30cc74e5e9fffe610666df97f82fd48cc269f96f06f430ce113a40b254623980fe75626aa10283844592b17e7d914b4aefe0d8bbb623b369b5026cb78b0fc8f4809ce109dfd91c7d1c93d342353066d3b48f9e8c8a6f86174108f61c3877b6ca56faa4ddc76c5d478ad4d036565afcc9313a0615adbdb098f1fc635
#TRUST-RSA-SHA256 6494ee0568a15c8c07b978474175839936d10c84196ddc03743b375e6e75e46514432b1f18d89d681ad52cbc4e5a2ab13ef0fc9f656d596d6ede3dafa04c96a43a4d41bc4d67e1c3730cb80f2a6e0ffd81bd554ca6a501332cde3fed1c96c6807ef7fa4e2b80a06d8e1019fce6a8bcbc953102dcd09e2b8f26666d26c4bd6139e97b8373534f46be0bd938a6356a809cf1171ec999291dbb8670256b4a9b655858710a670f3011dcfc1f3ab43d7b42d30d2caa1b31b9f394b66362723b617eeba9a899f72d4438b28879bb31f8b1d162158c9fb4d4abb43faa5e717c4955b124d162bc04ad4dc8e6ddc0ae12df860c54507defbc4fb11d79ef0797cfdb6f86e29b74e989b841abf00ab7422dae1e63bfd757c2a5cce09b5679820ed607ab50d00a686eb9b4579be585f4e3959aafa24f3e55a2f5bdcab98ac1ea141ba737008fd9f01818058b4b6789ad34cad7280c783a409c3f402730db4e943b0e921eae30abe22e7ae4e638b195e127cf2ea49737d953c00072dd86d6f0c8c6450ea7774f75d118985f241e9e15bc555840a08f0189763fc5fb3324d8bf9e2470681333ad674866986bd6aa7411d6cdab7521504cac7530d30931b129652887f3c072dbc95038a0b363b0211cad9dc868b59641a12507f8105e4390389f3c7e05bc1103ac83a7f6e743a58605cbc5aa4c4bf3066bd5d8705f78be59313e8bb5a50ed44e7d
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
# This file was created in whole or in part by AI.
##

include('compat.inc');

if (description)
{
  script_id(310451);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/27");

  script_cve_id("CVE-2024-39558");
  script_xref(name:"JSA", value:"JSA83018");

  script_name(english:"Juniper Junos OS Vulnerability (JSA83018)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA83018
advisory.

  - An Unchecked Return Value vulnerability in the Routing Protocol Daemon (rpd) on Juniper Networks Junos OS
    and Juniper Networks Junos OS Evolved allows a logically adjacent, unauthenticated attacker sending a
    specific PIM packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS), when PIM is
    configured with Multicast-only Fast Reroute (MoFRR). Continued receipt and processing of this packet may
    create a sustained Denial of Service (DoS) condition. This issue is observed on Junos and Junos Evolved
    platforms where PIM is configured along with MoFRR. MoFRR tries to select the active path, but due to an
    internal timing issue, rpd is unable to select the forwarding next-hop towards the source, resulting in an
    rpd crash. This issue affects: Junos OS: * All versions before 20.4R3-S10, * from 21.2 before 21.2R3-S7, *
    from 21.4 before 21.4R3-S6, * from 22.1 before 22.1R3-S5, * from 22.2 before 22.2R3-S3, * from 22.3 before
    22.3R3, * from 22.4 before 22.4R2; Junos OS Evolved: * All versions before 20.4R3-S10 -EVO, * All versions
    of 21.2-EVO, * from 21.4-EVO before 21.4R3-S9-EVO, * from 22.1-EVO before 22.1R3-S5-EVO, * from 22.2-EVO
    before 22.2R3-S3-EVO, * from 22.3-EVO before 22.3R3-EVO, * from 22.4-EVO before 22.4R2-EVO.
    (CVE-2024-39558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2024-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-specific-PIM-packet-causes-rpd-crash-when-PIM-is-configured-along-with-MoFRR-CVE-2024-39558
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1c69a886");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA83018");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/R:A");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-39558");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/27");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');


var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'20.4R3-S10'},
  {'min_ver':'0.0-EVO', 'fixed_ver':'20.4R3-S10-EVO'},
  {'min_ver':'21.2', 'fixed_ver':'21.2R3-S7'},
  {'min_ver':'21.4', 'fixed_ver':'21.4R3-S6'},
  {'min_ver':'21.4-EVO', 'fixed_ver':'21.4R3-S9-EVO'},
  {'min_ver':'22.1', 'fixed_ver':'22.1R3-S5'},
  {'min_ver':'22.1-EVO', 'fixed_ver':'22.1R3-S5-EVO'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S3'},
  {'min_ver':'22.2-EVO', 'fixed_ver':'22.2R3-S3-EVO'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R3'},
  {'min_ver':'22.3-EVO', 'fixed_ver':'22.3R3-EVO'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R2'},
  {'min_ver':'22.4-EVO', 'fixed_ver':'22.4R2-EVO'}
];

var override = TRUE;
var buf1 = junos_command_kb_item(cmd:'show configuration | display set');
if (buf1)
{
  var conf1 = !junos_check_config(buf:buf1, pattern:"^set .*protocols pim");
  var conf2 = !junos_check_config(buf:buf1, pattern:"^set .*routing-options multicast stream-protection");
  if (conf1 || conf2)
    audit(AUDIT_OS_CONF_NOT_VULN, 'Junos OS');
  override = FALSE;
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_WARNING);