Juniper Junos OS Vulnerability (JSA88134)

#TRUSTED 1f84a049238e9587a3949b392b2d24972e32001f6382bc4a9b3c43de1dcd15c290145329f05176c7e4baf20edbd49b3495bf77b97ca2dd14c5289a999ec86d47fab09e35ca8c17be845b5dfbe03b22501d83ce61af3c7f72f669961c51884a7da018631dbcc313a7424524b152d70aff250e794013a407600a84b63482ccfd199072864eb93fdb1e89c64631d38a947268ac7f2479a5e11b93079639bc7f660149e624a768ab9ffcedc613f43f1ca0810e2de85942c67f0409773e47a7ed67900334151d011f521a13326262463bdedd31e3929973ac6608f129ad0d922d04906393aa2b14418afccf1672d770eecac39ae2e96b1bfa7c4057ee5dfe225b3e101ef94cebe70f3393dd1e71b98ec2bdc840d25f3e7e48329c7bb89cbb8a0e4204957a3f7d7f2dd0f4e4e43d5860546d90efd185856b5e8adfc0463840a0f1e85c70a616cc73d0b9a26c0184c11b5b9f2098a216209ea1d6845044b138aaba5f8855914dd73d6928a7434e2de06b9085fbef3442bf17a18140632b3b81f372a09528ae6c8f13bc5bfadfb23e388233f508983b5727a0c0151d229057ea286d208db8a31e4194b12c02bb975beb969579256fbfdf48b76caaf4ab07793086bb17acda10de44676934a733d61438689b64f6941cbb6a231d395d73266ed7400d51f72f2364e12046142f327be4c6b89aa142e7040fd427cadb5c5f6053dbc571b31b
#TRUST-RSA-SHA256 1383f855c0c60764315d45985a33bc61dbab02613fb44e3d8b55da3b7a152e384a86db455e6903d62d643b03b93d21e26f78c335f178017ea2e7d82535252be5e8b3d47ad0ed9e0d9cd931998903d39356f999099d9825edf07929acb2d719e1bd408b2b08c265e6f768b2f4ac97991c67bb8b008be5387f3587a78898461624465e32e0d24b0bb29a95ab258fb80f2677b656436f3d5933403ebf2d1f1b637e836b54241ea2091676e7bf6f0f9b9e75138f550ded6c62edb809cd6079166dcb4811ff7da832c2aa753eb8459178c4dc9aadb04832977109a97be89eed63b5870dbb1136c739d77a7decbd07023af14bad22f1eda85cf0e9da7a6add812755a0d1872a2d478df086d8e8e6920ec18e92140afa5f6fc03e231630d74e3f7925742733b6328102a67cc0a7533a32e553aa7ac3dda19ca283cb02d5ba648a574e520bfaab57484100d56b95eb7e2cf389cb3056948328b5de291b31ca23515532c8d477cf5e693a73892cf30823a77c528460995795ffccea8f37eee657d3c1fc9d96ea093ab4a8113a47bfdd85a0653901b68048869af7d9ce1b244e9f54980b49f46263ba79ba236d83bc2b351b00a00312866a2bed182254bdcc90ae87c79851966b8f0cc1c08e766c6d80e0073c798276bd367e99a7444e7656cb50b5ce9dca6d570580b2dbba2f5c8285d5974bf3b0fd3047463ee51316ad9e95627dda5469
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(212709);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/22");

  script_cve_id("CVE-2024-47504");
  script_xref(name:"JSA", value:"JSA88134");
  script_xref(name:"IAVA", value:"2024-A-0650");

  script_name(english:"Juniper Junos OS Vulnerability (JSA88134)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA88134
advisory.

  - An Improper Validation of Specified Type of Input vulnerability in the packet forwarding engine (pfe)
    Juniper Networks Junos OS on SRX5000 Series allows an unauthenticated, network based attacker to cause a
    Denial of Service (Dos). (CVE-2024-47504)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/JSA88134");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA88134");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/AU:Y/R:A/RE:M");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-47504");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/12");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}


include('junos.inc');
include('junos_kb_cmd_func.inc');

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');
var model = get_kb_item_or_exit('Host/Juniper/model');

if (model !~ "^SRX5[0-9]{3}")
  audit(AUDIT_DEVICE_NOT_VULN, model);

var vuln_ranges = [
  {'min_ver':'22.1R1 ', 'model':'^SRX5[0-9]{3}', 'fixed_ver':'22.2R3-S5'},
  {'min_ver':'22.3', 'model':'^SRX5[0-9]{3}', 'fixed_ver':'22.3R3-S4'},
  {'min_ver':'22.4', 'model':'^SRX5[0-9]{3}', 'fixed_ver':'22.4R3-S4'},
  {'min_ver':'23.2', 'model':'^SRX5[0-9]{3}', 'fixed_ver':'23.2R2-S2'},
  {'min_ver':'23.4', 'model':'^SRX5[0-9]{3}', 'fixed_ver':'23.4R2-S1'},
  {'min_ver':'24.2', 'model':'^SRX5[0-9]{3}', 'fixed_ver':'24.2R1-S1', 'fixed_display':'24.2R1-S1 / 24.2R2'},
];

# Only non-clustered are vulnerable
var override = TRUE;
var buf = junos_command_kb_item(cmd:"show chassis cluster status");

if (buf)
{
  override = FALSE;
  if (!preg(string:buf, pattern:"Chassis cluster is not enabled", multiline:TRUE))
    audit(AUDIT_HOST_NOT, "affected because the chassis cluster is enabled");
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix))
  audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_HOLE);