Juniper Junos OS Vulnerability (JSA88123)

#TRUSTED 577511a8482c17b125322f652ef7d0261ab0a3fa364906af78aa2175a518daa059f4e36222c4a6ac516c92538ee6fa6ec5023d23ba3a6151704d2af374389d488fa9ecfa43cb8df1936ccc53947e55e30fba7cb1654b2e647c51121e1b709bf528f31f5dbc9cf61e29eed3fa34dae8fda46f9a23601128c068dd7c310ac3e9e71a334faece5b414280753c4e2cd3886a284aa1002a32d5288d3b0484c54a9184dc8745d62c1e238ce0607e2dfa495635b5ff5d0c3285cf2a7df16e6b29b4cccb3b0fbbcb3f103049b4a67ec6a8e76ae1d651143037b40d1f98bfdbe0dfed3fb3605b908cbc20dc6a159ab8eb8ee6c0ea71b05f7d9f54005ee23344971462ab81d3820bd1f6354af86f1d1091e572918b5061ea54e41b2c8c91cb0c264f8fa6708bbda66a561dc937f6d17d2232103848d7ac3d93720a015ab8a9e7fcd4357ac0fcffbbf4ff26ad675b2e1895aab5f1cacb4f3611545baba27b453d4de88e1b615da00fe9ffaa370773227a5e33c318a3ad852f254e7e337a8642086705ef92eb92fb610cd1d01e4dced55baa9ce76305b48faf8c9263b903d45a44ccf108a70db17469d1b539ea56070f7f5b733db8c2c289d271262e1306f59249975c642f2113ad7cf83b7358d8c27e78b6b00a62124ff312e68ef106e43c2e83ad6b140261c1a47a4971fc42a5bffb91a1baa1443c66cc5bb07680c6e288b4fd5f721ef78b
#TRUST-RSA-SHA256 16ab86623bab026945f9210f46ec762ae05003e8ecf64b6548df8a0e90e03d49f50d89bfc10f1f69715b171fa7b8474d3ea06416748d1e06c0e275c962c9595c0c7ed26a3969b595f1b61e730ab37b3ab5c040e6e1eee840601fae81dfc780e92a01984ff1139b853aa8ea83360fc8371a6df9d4d6e1753a7299752ce027018ebabb670ba054027e0f45ab02c9d70471df1c0915893cdf65fb0acce8c5814261f1373ed0d63fdb0c9175f9b734d5031c4ddc30fac1a82b75d89a5c3c2a17867feb64aa6c986e2236e9d92d59a2db3c8f804c4ab7214a13e0fe25bf56ad25a391232517d54656b4663893362615c8a9b868c27ef4ca1db61a5e7fdcd31bdfd0b9224d5368563b17d6cd3d25dddda93b9e4fd479ec7f31431a38b6c8f14225f19073d56d5480026d2ad438e8293b3629a6f91e63319be4cf920b351edc19d348f6299612244fee1593e4772aacafdd879f474d371ed5d155a2c1afef27971a462a8e0ff593bbf8143d1d8fd77a9633e25aa37c784853ed319317afc1feffe7508e2a4a222efec8da82c9fb3c42cd861a233c0b5c2ff03da91fd57efa246d116174c612597a6ce51e41ea03165fdf5dfbcad8a5c3558be1ff8cb231b283965178794910bcff42718a04d692eceb6e4b0e56e9460327f82810eff930318838199c0a332eff05082ecec914a2a6eb65345430d2696148843c673c04f766a3ba86b819
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(208474);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/22");

  script_cve_id("CVE-2024-47496");
  script_xref(name:"JSA", value:"JSA88123");
  script_xref(name:"IAVA", value:"2024-A-0650");

  script_name(english:"Juniper Junos OS Vulnerability (JSA88123)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA88123
advisory.

  - A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos
    OS allows a local, low-privileged attacker to cause a Denial-of-Service (DoS). (CVE-2024-47496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-MX-Series-The-PFE-will-crash-on-running-specific-command-CVE-2024-47496
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?299162d2");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA88123");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/R:A");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-47496");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/10/09");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version", "Host/Juniper/model");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');
var model = get_kb_item_or_exit('Host/Juniper/model');

# MX device check
if (model !~ "^MX")
  audit(AUDIT_DEVICE_NOT_VULN, model);

# MPC1-9 check
var buf = junos_command_kb_item(cmd:'show chassis hardware models');
if (buf)
{
  if (buf !~ "MPC0[0-9]")
    audit(AUDIT_HOST_NOT, 'using an affected MPC card');
};

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'21.4R3-S9', 'model':'^MX'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S5', 'model':'^MX'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R3-S4', 'model':'^MX'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R3-S2', 'model':'^MX'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R2-S1', 'model':'^MX'},
  {'min_ver':'23.4', 'fixed_ver':'23.4R2', 'model':'^MX'}
];

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix))
  audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
var report = get_report(ver:ver, fix:fix);
security_report_v4(severity:SECURITY_WARNING, port:0, extra:report);