Juniper Junos OS Vulnerability (JSA88106)

#TRUSTED 77d7388e3a9199ed28779f172a0fe7a361d54fbd3a87d08dcb8144ec124344b7f8f1d03369f01445033a0c7f5f935787fc3d4cb0359e29bc2ef0e17e57e4e12ff630c9a2264806f447ffd813411c808c129d5956a6de2104881fffb1295dd7c70764a94661516643d371b038be263a6caecf7757ff469129296d14f7bf191860723c3347c22e4f9b627c3446fab3559c2f788e98fdc90505dcedcc2c679fba49e7b64563a528105e3a8a5b8fc57542e85cd16f11da33d990888ade2a296731e5693c7510bd724c3172ea340587b2b104fc5936eb82a9a2dd430d1d341ed8e85dd95baaa58c63f06274a8cbc3bee55ca918799271d6b899476bde88d7d9bc39b554db8b7452dc99005cab6b4175b3626e8939ed95737c081c0653ade3dc97efda9e798a281098c55a7130f503c5fff8f5128c1a0cbd01de05d63694fc0c269f6b2d6e85ca54c7f6d80ac0f21b34c2b0055655dc16da3410eddd1006adbed93581e2d4ad3f1213d7726e59f0060b47d1167961a64b9e39693414d7d9c114e96dae28b26e45535bac63451aa2655a559d04f63671cb550217ccf850d5f30ac16f2129501bd9d0e08579fb0cf0c7717a8091cabfa12dcf46e1081e7289f4512e6b6dd224f557e8d9d503d535c76c6e117621d173a436d66f8f533f677a4480459ee6a0add5aadbbb62dddb7db48afe1d0d62619d7478b41cd50503902c12a8c42cb8
#TRUST-RSA-SHA256 68eab942b614a742c808d5740a823468723120e957ad8396b07f694c5a51dd1152b1e15f6f261033277bf41b763fbdc5f28e61243887a6cfc2bfd200cff3da7029db610066e9b59f8e56a5051e378a153936445e43b6c36d8c5f58ce782780a99a0e1033221e6ca8aa56979fc27db2625cd7014e66241dbaa94fe30f410d53822e7747ac4ad9b611c707dce9a2e3a6d5880cf70f699db010acec4a94f079f750f2691ffc56d4f1b5762b35117bd2e5f0738225384a02dee0b78e12fc6341dfcc294fa85f9f342157e95f812bd04a4204726e5fddd7aa45d47c064c05a5ec2c7508861cb246d8e3a89caf964490042ff492e67b0e41ec01976cf19b8ed8c78ecef480c847a76795262fa9e4d75ab3e331ab639633df04d1a9e608d8f4a87891f3b754becdf997cd1e03cf1ebfdb00b572ca206566191ca9bfb31b48e738954554ee1c3afe16e652fdbecd72559bbfdf04d885a82b57cdc8c661c0e6b9e1ae4844ab7c2226dfd9dd412d3df4c6bf778d20a4c98d65e6e614a42415faa3e3e6612ee1d16c243b60d4103c81a98d1fa7b09f3e56c2bb76ff7d7e6c6ceb9c2f56a06dfcd9ef222a884045d49439b303e7880d56315f0bae4fcbce2932b131f6fb259b31c46c8d930379d74b4a48a2c74d80bff82e391e5def344021263933d911ecc31b2d74d106db1bddc7431cbff0c9f954a9871e2977f8062c0816ad9d3e30964f
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(210491);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/26");

  script_cve_id("CVE-2024-39544");
  script_xref(name:"JSA", value:"JSA88106");
  script_xref(name:"IAVA", value:"2024-A-0650");

  script_name(english:"Juniper Junos OS Vulnerability (JSA88106)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA88106
advisory.

  - An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks
    Junos OS Evolved allows a low privileged local attacker to view NETCONF traceoptions files, representing
    an exposure of sensitive information. (CVE-2024-39544)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-Low-privileged-local-user-able-to-view-NETCONF-traceoptions-files-CVE-2024-39544
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6ed78a71");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA88106");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-39544");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/07");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0-EVO', 'fixed_ver':'20.4R3-S9-EVO'},
  {'min_ver':'21.2-EVO', 'fixed_ver':'21.2R3-S7-EVO'},
  {'min_ver':'21.4-EVO', 'fixed_ver':'21.4R3-S5-EVO'},
  {'min_ver':'22.1-EVO', 'fixed_ver':'22.1R3-S5-EVO'},
  {'min_ver':'22.2-EVO', 'fixed_ver':'22.2R3-S3-EVO'},
  {'min_ver':'22.3-EVO', 'fixed_ver':'22.3R3-EVO', 'fixed_display':'22.3R3-EVO, 22.3R3-S2-EVO'},
  {'min_ver':'22.4-EVO', 'fixed_ver':'22.4R3-EVO'},
  {'min_ver':'23.2-EVO', 'fixed_ver':'23.2R1-S2-EVO', 'fixed_display':'23.2R1-S2-EVO, 23.2R2-EVO'}
];

var override = TRUE;
var buf = junos_command_kb_item(cmd:'show configuration | display set');
if (buf)
{
  override = FALSE;
  if (!junos_check_config(buf:buf, pattern:"^set system services netconf traceoptions"))
    audit(AUDIT_HOST_NOT, 'using a vulnerable configuration');
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_WARNING);