Juniper Junos OS Vulnerability (JSA88105)

#TRUSTED 7711151e1da23724ae6f5a461f69226dcba4f90c7d7630733cff4d19316592f486ebe5a929d833e1fb188aeeb3e86ada988b5239a9c0b999731f1d154651d8ee05d9c39006c7b849a0ef0a598b2f79fbb587fd8d6a2d9f637249388b8ebc2bb376d5089d07c8b73a3f95b0b98e7b209987b8395617c19ae0a1f6e0dd02e1e7487f4c1eef572634731da4098432dfe214977f7158ec2a5323c45f914b5e279aa685d77232f271e5507d0bba2437b8a1ae250994d70c0b18ed18869dbc0b4a8eecd83900094301bc8398bffcfc5382d2d6ebb7bdc456d9d01339f5b5fdd00761fd3b3a076fc60ecbdf3b79dca75c820c98051dbd7c16dad3bcfca8320212ee4b3e03943083e6ff525c42716af0f055ea559edfbc0b3d1eb64d59808b0dd069db6bcc4093846456baf245e47d9e8ac2b887160e3b021b480001654f5239d16cb96c13447e1a9757b41bbfdce547ff8f28cae04324a0d9c37ba1a9d958e3bff28986510ee99a63f2855e5ae043350f5a36f91a1809d9503635d1335d865b9f0335ce29d29a9448dd910f1c96ca5bcc2e84040a482421d6ec5c47a9d9a8cb27e5989439450c928517423729607e7f1f49d8f2b21a0b86df072fc87286df6df54d440bf910c9bf8d812412d65895fc444e7b313cc23df1edd3be2b1bd5075ecd7133692e664414fd84ad3ff622d5b8d9b0efe70e92f1e780d6f406ac5ba09e723aaa5b
#TRUST-RSA-SHA256 6473223bf69d5240a271526dd719b1813552089ce19eb1a2bdada171724a4c00968f9ae45528b757c73e201966573a0256a83edfa751ca0b415f77f70284f163ed53862be52b3bbede3c55640032f4ae08e0934176b7ce54027001049b1d2eef50b8734f93b4668d7e7a763071897d0f6777ea6ee679bd9b3de956297476216224f2b02300eea7ee1c2758f1d062daa4aca64c8fa0910bff2fa157e378cd16ba4c41042b3d31b6e11f15b6ed0c5e07ccabec8bc28de0060a8e7fab0ddbed10b2318291319955485b1ded9dcaf3ca380303662007632dade2d178de885ddb2c1d1a3a18b51d014ef48a7d72d5cf149c3b81b23d20713feb9e0ee34eafa376c0b075cd03e7161c111566eb0aa9e66a3d7a97bc2d480f5804cb0a4fdde21f33c5bbf44064bee4d1855a3eaae9067ed21b606e6f9a845ff187bdb4fbeeb0625525067df7bfede76a8200631c211d337d851b06566399f007e3899d65d777ca9a78c3f794725f5bddbe47396833406ec70ff24a32a92d03106afb6238f687187c617aa1c24124465e9dcd0d1a0b4b539057047e6a23433b586d55dc2e4b25e52c98c2c16b4a1d37a6789c44a76babad2f9af02741306df2a11831801bbe4b0e2bd12de43dd8dc6b528a1fc336dbf098a0dfc6b3e7fb54bcc24a0a25b350b59e0c4cf19534fb14abf48f8b107071b6d1236951be22c68122fa48d56eeb5c0e062c4241
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(210407);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/26");

  script_cve_id("CVE-2024-39534");
  script_xref(name:"JSA", value:"JSA88105");
  script_xref(name:"IAVA", value:"2024-A-0650");

  script_name(english:"Juniper Junos OS Vulnerability (JSA88105)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA88105
advisory.

  - An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS
    Evolved allows an unauthenticated network-adjacent attacker to create sessions or send traffic to the
    device using the network and broadcast address of the subnet assigned to an interface. This is unintended
    and unexpected behavior and can allow an attacker to bypass certain compensating controls, such as
    stateless firewall filters. (CVE-2024-39534)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-Connections-to-the-network-and-broadcast-address-accepted-CVE-2024-39534
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f3104ff1");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA88105");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-39534");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/06");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0-EVO', 'fixed_ver':'21.4R3-S8-EVO'},
  {'min_ver':'22.2-EVO', 'fixed_ver':'22.2R3-S4-EVO'},
  {'min_ver':'22.3-EVO', 'fixed_ver':'22.3R3-S4-EVO'},
  {'min_ver':'22.4-EVO', 'fixed_ver':'22.4R3-S3-EVO'},
  {'min_ver':'23.2-EVO', 'fixed_ver':'23.2R2-S1-EVO'},
  {'min_ver':'23.4-EVO', 'fixed_ver':'23.4R1-S2-EVO', 'fixed_display':'23.4R1-S2-EVO, 23.4R2-EVO'}
];

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
var report = get_report(ver:ver, fix:fix);
security_report_v4(severity:SECURITY_WARNING, port:0, extra:report);