Juniper Junos OS Vulnerability (JSA88121)

#TRUSTED ab0d6c4a2f2902eb9e1248dd03534d206bf4e71d8b6b98112eff5b07be3bccfa6b5668932d4065edea2aca1ff35cfdabe9c566559bad0550d5c10f891c3b991d15ff6e4a5a85c47758f5354dddac15f19c472794bcb98cb4ca63415155198c033be4356a659be804aecf359e8a25e9df88a2bde03146acb1bc7de001b3de1fdabcbd51a24f9c24d544a0eef00c3cbefc4c893936461d9b63e95dbcf8af845733ef1c52b0cda4f948d03451f9abd87639bf19a94f9981374d2fd1b45b1b35d19bcb10a4c70818fda521a504531542c6cde2a399d7c53c22e4ac01c8ce645cf1e0c7f86b8592ea59635231156605ceb04c8a696253dbc81788c75b0d1bff9398ccbb81e0987a56493bc312e532c354a51fb6dd29cffceb800ba8b97931425709029ff461ecdc20d2dd4d52eff02caa171f3452611aa480510c5d46209512eab376e017475cc4ebcbb446da323a2ced8c540219f27007cea9cc70c084275eaed4a234b5c4ca32fee84b061bb973bd50dfb6e3a4c3ac1962068e64207af3966aab06c593455ea9de53f211956c4741eb8cdda89c55e74bb2aac8e497c3a82fa249c61911943714d89309ff5084ec4067b51b2fe74fa1193c59a29676492de786098204ebefcf049d81646572372c0da328041a1717553b5dd640833965e65bd0e5501c83d9a146bfe711aaeb5e52137da90d44df6d9fb72d37a9f9cb35a24249e848
#TRUST-RSA-SHA256 60ac79a3d5808671da8fe623451ad8db7fec99f13e65ae42ecd87a6d35d10355f40291ddd6b45cb78be0a98e7b8ba96312a300c6be092d4cf5ccd377dfbd8b2fb60ebb1da778767ec5d6923b4e92829315836e743b011998abdbf4cb945a5d452965f900012de8fad18f334e26f7798bba2d02b562936ac2793f9c407b9ea7878e1f7f1b3d826bc8a483ee8ff80d2538e0baa3998417448e8d91a58430655c00fab7f887835ec5f930c7692502709a37c53090081d4860713e3f12d053049d8721b4a0255892b2b04fe6787493db7417188f254340ea04970260f26ce1ae63192482412344d5da58f88260692bf9e7004826c5c49e96b09f217590eb04fa3848d04ce4748032779f9f1a8ee357024ec4ae91d148b5b38e44dfecc890a7bc492178aa0f2e7523097ae5a97548a5e5386b2d8a17861fffa3c00eaf1adc889dc3b3e281a19779fbebf09746df98bf3bd33a1da7a8e9b05fa4df8cdc1b40ecb461e83798f509f57a655cc965e95a21596bcf9b78588fd706919d5ab72b852ce6b3acaeb90d59aa28f10dd446b3dba6211efa1c4cab15c4416d3019c4b0d69916090ec998b671b79bbea23f3e0842c6bc9815b6bcd05a202623555535f2bf9a2165f65e0b1e6a6b9c868ad8b2ff2f73a515377e5886940d32bad652cadd90fcbd28fe5b76bcfabdaa86592460264e926052a1e96daf41b9c0342ccaf4484f7868f20b
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(211820);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/22");

  script_cve_id("CVE-2024-47494");
  script_xref(name:"JSA", value:"JSA88121");

  script_name(english:"Juniper Junos OS Vulnerability (JSA88121)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA88121
advisory.

  - A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the AgentD process of Juniper
    Networks Junos OS allows an attacker who is already causing impact to established sessions which generates
    counter changes picked up by the AgentD process during telemetry polling, to move the AgentD process into
    a state where AgentD attempts to reap an already destroyed sensor. This reaping attempt then leads to
    memory corruption causing the FPC to crash which is a Denial of Service (DoS). (CVE-2024-47494)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/JSA88121");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA88121");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/AU:Y/R:U/V:C/RE:L/U:Green");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"manual");
  script_set_attribute(attribute:"cvss_score_rationale", value:"Set to score from vendor advisory.");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/25");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'21.4R3-S9'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S5'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R3-S4'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R3-S3'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R2-S2'},
  {'min_ver':'23.4', 'fixed_ver':'23.4R2'}
];

# Only vuln if analytics agent enabled
var override = TRUE;
var buf = junos_command_kb_item(cmd:'show services analytics agent');
if (buf)
{
  override = FALSE;
  if (!preg(string:buf, pattern:"Agent ID\s+Output Plugins\s+Input Plugins\s+Process ID", multiline:TRUE))
    audit(AUDIT_HOST_NOT, 'using a vulnerable configuration');
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) 
  audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_WARNING);