Juniper Junos OS DoS (JSA88102)

#TRUSTED 77fadfa1c06798c2e12fec57d27140e3bb77b77f9ff3e98f237eb10652ce8e5f7a46d30cc3141a8554dfc989da61c8a38330c821866aeb492dd290afa5a9bb9788b21425f0d1a35005f90f256393460865e403a3a415f1688183065c73ef6d325699543bb627f9444e9f93c57ef6163104ac36ce8d9a47a3ebee8f46463542c19e1db984ab82e1842c33f892773bec01dbf5f7d6e8c699e79f3c8cbed85360b08f77bec23f219977460fd34bd27442a7fb89ddc8e3a9c0a2433dd783778f13160c81dfe9e1b4a301b6f8d184369b9f5c5941abf7bced67a3f83ad01c8115d74c7060923684e22105032423c11663bae20336ed959d182e8878d9fd9dc59ce3102c26431ba2f3af6dbb0442146e825e1a7852df1ba3f589ec4994d6fe07b595403294d427795f2c7587d8bbdead0f31a60011749d31372c93f59d4e844301ce20e3d3778f31df0a0c108620faef3ae7890d75005b6a86fcf3b674f2698b57f5b6402456dec41d17f20ec99c9dd1f728b8246efc1890babe7b98e4e2f7d44fef2133aa9223fecd6baf5947e6809479abd1cff929ec528a31ff0f57484280d7c52d330187f3f18f4fdc4e2051d32fb90f77e2e5fa9f061cf6abff270ecec33d6914c75732fcc5ee7697137c1f7e20ca6fa1c849705da4e2b71255e60bb23e9c102c4f8f07f8c6179d132d47b1a68657f3c8b5a21205e933f0da52b4cd9f0f5dc684
#TRUST-RSA-SHA256 1d5e00171128bfe8d0109152e9746890f0b1dd91b33891c57ee5c39455ef0c3d3b8317231fa5258fbae95ff38b60f64e3ae138c4c787148062ed4148a0df764faf32c97ec0cf64a7b980865d8d921e63f66731bd7555fbc7f86e0ef656d5edf23d593e7cef59e9af136228cd5a126942db6058d16a354a166c49a5a811f408d40cc4f92f3d218c7953e090adbbf37be6c74a1fbe300645e9f0181a9b4879cf5d46b2a09b9015d6a5986ee6d4823a425d95b2b438b8dfb2c088211994d223cd037f1942b5a87a03632dab50c4479973cdec6c79de23d82eecd190e2df034ae56f88c7ec1d37045bf4b125d4193462a7dce787c99bc3497acab7cb383ed457b66d1c27cbd11af799e17dbc9b12184ea7af1f9aea9a7ac79f222d9254523b24e23337fc519a7985e46948b1ebcc222a54da800b48b2d8cf5f3734afa67dea2f4820fb900e314ccb7852f63ce97f5de824d3aba14e478e503aa1f0d80bbd743a4a5f034d8159dda7b575aef7a73191774ca5b49067d7eb4e270630efb11e99e7dc212140ccac511170eb9df52a15f7b814c4239ce2f8f29e5c9302b4e9b5f93db3909932f2f77dd48f958847fbd63797a021592e0ec499186a9f246c2a1e822b1733b39570ba0d0424281cb904b1db057ea031d9b8687d941a7e3402c3bc0f668b08dc031557b2ea6cbd9146c77f9d7bfe783ed5fa088ce4e6922143f780a4bb9054
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(209273);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/26");

  script_cve_id("CVE-2024-39525");
  script_xref(name:"JSA", value:"JSA88102");
  script_xref(name:"IAVA", value:"2024-A-0650");

  script_name(english:"Juniper Junos OS DoS (JSA88102)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA88102
advisory.

  - An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of
    Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a
    specific BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued
    receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.
    (CVE-2024-39525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-When-BGP-nexthop-traceoptions-is-enabled-receipt-of-specially-crafted-BGP-packet-causes-RPD-crash-CVE-2024-39525
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?63aa98ec");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA88102");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-39525");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/10/18");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');


var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'21.2R3-S8'},
  {'min_ver':'0.0-EVO', 'fixed_ver':'21.2R3-S8-EVO'},
  {'min_ver':'21.4', 'fixed_ver':'21.4R3-S8'},
  {'min_ver':'21.4-EVO', 'fixed_ver':'21.4R3-S8-EVO'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S4'},
  {'min_ver':'22.2-EVO', 'fixed_ver':'22.2R3-S4-EVO'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R3-S4'},
  {'min_ver':'22.3-EVO', 'fixed_ver':'22.3R3-S4-EVO'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R3-S3'},
  {'min_ver':'22.4-EVO', 'fixed_ver':'22.4R3-S3-EVO'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R2-S1'},
  {'min_ver':'23.2-EVO', 'fixed_ver':'23.2R2-S1-EVO'},
  {'min_ver':'23.4', 'fixed_ver':'23.4R2'},
  {'min_ver':'23.4-EVO', 'fixed_ver':'23.4R2-EVO'}
];

# BGP must be enabled
override = TRUE;
var buf = junos_command_kb_item(cmd:'show bgp neighbor');
if (buf)
{
  override = FALSE;
  if (preg(string:buf, pattern:"BGP.* is not running", icase:TRUE, multiline:TRUE))
    audit(AUDIT_HOST_NOT, "affected because BGP is not enabled");

# A BGP peering session is established.
# EX. Peer: 192.168.40.4+179 AS 17   Local: 192.168.6.5+56466 AS 17   
#     Type: Internal    State: Established    Flags: Sync
#     Last State: OpenConfirm   Last Event: RecvKeepAlive

  if (!preg(string:buf, pattern:"Peer:.*State: Established", icase:TRUE, multiline:TRUE))
    audit(AUDIT_HOST_NOT, "affected because BGP peering session is not established");
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_HOLE);