Juniper Junos OS Vulnerability (JSA92861)

#TRUSTED a2b37044553a2b26ac43c4f5262e321d10eb096c01e51c0920c7fc6c0f5fb96a3c2f14ae7b8a997bbd0f1f0c73417689afb39210d6b0c80a80f7f0499b53315adbde29178630cd2655e3ea21f18c9612623a732b886ddd9db0c92a989a7866c3fe833c8d91e8344b732914f8aa918a899541a0daa9a61384a7bdc748a86bc12fdb8ff849ea301f64e4dcd0bb9ad5e84d557aac41544aecd5f702e17ea4d8df41087dbcd1d3a85dcd90e02c18443e4a88305117ab74e8a6dd422e24a12035cfba6124f667cd405a5b83be9a20d3386b574fb6f61669d8740d2276bc74998c7a2341b76dafcaa637f809664b2e73eb9b2617cd7b6c46f777cf24dd876882fdf4b01d59b8bc078fcce2f3fadf4aa2279e9a99fd65ed95e7e38a1de217de5fe48cd5616c2b7d5570b1166748a20714cae48b0ba651fcfea344b62ed81aa7079c0080c8932515409f92901ee2629d690dbf20b8afe5416692865c8f2c8fa5f54b7f0462d79a7fd025753a15ba01afd70833f40a62f3c213889ec13ef5f3c14157ac2b83d7c9f041085cb3139029828722c099fcd81ac55dbe5d4fe1884dfd3d5b95bc579b12cafb73df380e2856044754fe798a8687d1433b78f8f0a25a584b54263e8d6f1d1680289f8080491b6dbd1d9a30291199f2b7ef5f0860b17f12e7dc84f17a2b0c5a65e62146ff6a6c51876876f44e8f5281d902beb87923a2070ff923ea
#TRUST-RSA-SHA256 2b37e6ffd5b75e0b10a68f8d539b3d4690195a6159167e36a795aab97049e470ce7b310800d16b551b8956fade02b133c7e8e245f7e2234ddbe3cc61fb372e1d2a0d64a3b346d79dcc4efb469688d3460bb4fe66ac2ff6e289a0ee502f2a1263bd4ae61063e9e548b3bee5d58a39d003e024191dd7c3d0f45657e5b60e33d5d53e9ad821e77cb5e3049b58a4043bcb6f5fb75acbf4f965177bcc065468a12c5b8086e56e0875eee8c9f775d9c3798dd128c9112fda1b0ae4a3da5a820e279ef5e4baba23a4cdc5696f4bdfc4cde087323ca5f77ac38a51e99b35f536e02ea6851801da0d8bb3e3a4c15f887e886d0d2093cf6c587c37f8fe07bc741fabef5ed2f925e4e20ffb7fa3e0a3eb08517b73f247d89c069e7b9089266faea1811ff86f36cfa002bbb55789a40642ed10aae1247189408e9d35abdc58a6397601e2aea01234dc9a2372ed496f4794d44418c6a4efadb53eb18e95020179abd07c6e6014c2d1ce0d18eabe218eab7eed97e73166f2b62b9a521061adf5362e52a426ffc9e49702b438cc9c6559e401d8cfff2b1826bd9b6625f2dc3d2348078b7cadcf58b52de2002730883bda586235e4b7ee3f73147763cc9ec4dfef7316865aa6cb5ce633da12185e872f05a4fe56173beed17ae493a52f8f371b78da11e9e3281e4c0fc5cb0dfd20095f923ebb1bd371f14e1e38106b860dc40ca75225dd28019a7f
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(264549);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/12");

  script_cve_id("CVE-2025-21593");
  script_xref(name:"JSA", value:"JSA92861");
  script_xref(name:"IAVA", value:"2025-A-0661");

  script_name(english:"Juniper Junos OS Vulnerability (JSA92861)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA92861
advisory.

  - An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd)
    of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a
    Denial-of-Service (DoS). (CVE-2025-21593)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-On-SRv6-enabled-devices-an-attacker-sending-a-malformed-BGP-update-can-cause-the-rpd-to-crash-CVE-2025-21593
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?93b4b1cc");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA92861");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-21593");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/01/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/11");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0',       'fixed_ver':'21.2R3-S9'},
  {'min_ver':'0.0-EVO',   'fixed_ver':'21.2R3-S9-EVO'},
  {'min_ver':'21.4',      'fixed_ver':'21.4R3-S10'},
  {'min_ver':'21.4-EVO',  'fixed_ver':'21.4R3-S10-EVO'},
  {'min_ver':'22.2',      'fixed_ver':'22.2R3-S5'},
  {'min_ver':'22.2-EVO',  'fixed_ver':'22.2R3-S5-EVO'},
  {'min_ver':'22.3',      'fixed_ver':'22.3R3-S4'},
  {'min_ver':'22.3-EVO',  'fixed_ver':'22.3R3-S4-EVO'},
  {'min_ver':'22.4',      'fixed_ver':'22.4R3-S3'},
  {'min_ver':'22.4-EVO',  'fixed_ver':'22.4R3-S3-EVO'},
  {'min_ver':'23.2',      'fixed_ver':'23.2R2-S2'},
  {'min_ver':'23.2-EVO',  'fixed_ver':'23.2R2-S2-EVO'},
  {'min_ver':'23.4',      'fixed_ver':'23.4R2'},
  {'min_ver':'23.4-EVO',  'fixed_ver':'23.4R2-EVO'}
];

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);

var override = TRUE;
var buf = junos_command_kb_item(cmd:'show configuration | display set');

if (buf)
{
  override = FALSE;
  if (!junos_check_config(buf:buf, pattern:"^set protocols bgp source-packet-routing srv6 locator"))
    audit(AUDIT_OS_CONF_NOT_VULN, 'Junos OS');
}

junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_WARNING);