Juniper Junos OS Vulnerability (JSA96449)

#TRUSTED 00476f7a22c43c05748982743f53f3562fc32db54965cc9b9cbf05cf5210dac015b1a6c4ff6c2328cb69db67731863037caf57a09f1e2d875b38b25f763f14dde5154763830d37e28707c181e52d64673956b9d19c4c9bafe2627da291da45a06bb101d093199d52fb4de371111fd9d477ef9db7bc0a9fa0bdadb4cdec7c3bd0ddc0acd30b598dd6fbd2d88cc6f05c935680dbbad9ad91a92f0b2985bc099500b5ec96f64971ecb0623656b07536e3cb321ecdf0122e50d82a3981cdb1296443164f4e9c2faba70abf71eac3c9a3c9d00a267c2bf8b6a08970426cda292b0bcc5a9b1c63eb5c6292d7a98a63720122e0bfd6dbc88a8984ddf8a4faf20872e59adb418c47698b010a0f961640ea3ab9ce986fb2498303176c4460189ebaddb779315432752c4c897a980e64a7c0231fc9ac637821251633934328969f8ecd39c67358f98f5dd334669df84b8da624749e43c3af2637374bf082f28ef89168af374b9b9e92cca75ef634b6d0bb4242f9639eadc366b0ff5d0f61405b8daaff8e662e76403a92b0e4b44b85217703f0a435ff140353bbae62bbdcc0535d170256438324db2619dd37ccfd7b9c0cbdb0a906fc578acea1d34f593fb830956d13645eab6d0fc84eac3fddcd1d55812db207066cdf3b409f67c07844611c521871e76e441d9512b95eeff1f737ba355d18f481f4e8aa292b545e8e88c75c5d15a3b5be
#TRUST-RSA-SHA256 5fd531af12e330a60c69cad04368ef1c0b004795639925144d408e208bd0cc8e75f1d1cb3134518748b5f46ca841985a1984d51cd4b7b1936b2a115bb3888331ff6e86deafbf0fdd796407ae538470a9b0f42d1bb9843ff857b65c3c57daca27c3839dccfcae0e00197013a9fa9d5c35e9e362e22d4206a31cb82682e7011978c450a7b8eeaf13a8ac2788a38b09ac15e5cc583e6b976e4a97123e793e635bb1b01dbede4c3ee8fa879304fa35d9d1e18f5c7329c39a96ed0433cb8ac019482b67b8f5ddb0691de8cb5e54e4870ff9384965fb1643612c8492de4fc8de3bd8394fe099b6103e98629dd623653921ec50d021946d2f0393a927badee10a5cd7fb0fd40c96b9b51598a37d68a1ea5f2b76277321e49a6537a274b7573fd94f23de1511ac3960ea4cbc39cd0ec148dfb281b9253c151e754a0fc4a54ce5b6c6eea9390a9b301585e64192218a90e17568311d90e15543a38255d1f4c476f81cc98adb55cb82107c2a0f5f87bedcf1d833252db36b5009192c4a6d94f21ddc6d8930d0138f85db1877edc3fea440ad7dd941bbc66ead78f05c082b8b5d90f892e1b1fc198648688ac43c2100756eab8bdfa1cfc534fb3fe03c741a631961a769cf0144a24c04b5626fe268dd39998efaa3b40cad24fec62fcde827cf7d9887745e32eba3efcc71360b78ad5fb44a3f6520b06809bf414d40a646659ca43ffc46b5c4
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(237413);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/28");

  script_cve_id("CVE-2025-21594");
  script_xref(name:"JSA", value:"JSA96449");

  script_name(english:"Juniper Junos OS Vulnerability (JSA96449)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA96449
advisory.

  - An Improper Check for Unusual or Exceptional Conditions vulnerability in the pfe (packet forwarding
    engine) of Juniper Networks Junos OS on MX Series causes a port within a pool to be blocked leading to
    Denial of Service (DoS). (CVE-2025-21594)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2025-04-Security-Bulletin-Junos-OS-MX-Series-In-DS-lite-and-NAT-senario-receipt-of-crafted-IPv4-traffic-causes-port-block-CVE-2025-21594
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bc480330");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA96449");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-21594");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/04/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/28");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version", "Host/Juniper/model");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');


var model = get_kb_item_or_exit('Host/Juniper/model');
if (model !~ "^MX")
{
  audit(AUDIT_DEVICE_NOT_VULN, model);
}

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'21.2', 'fixed_ver':'21.2R3-S8', 'model':'^MX'},
  {'min_ver':'21.4', 'fixed_ver':'21.4R3-S7', 'model':'^MX'},
  {'min_ver':'22.1', 'fixed_ver':'22.1R3-S6', 'model':'^MX'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S4', 'model':'^MX'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R3-S3', 'model':'^MX'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R3-S2', 'model':'^MX'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R2-S1', 'model':'^MX'},
  {'min_ver':'23.4', 'fixed_ver':'23.4R1-S2', 'model':'^MX', 'fixed_display':'23.4R1-S2, 23.4R2'}
];

var override = TRUE;
var buf = junos_command_kb_item(cmd:'show services nat source port-block');
if (buf)
{
  override = FALSE;
  if (!preg(string:buf, pattern:"2001:.*::\/56.*Active\/-", multiline:TRUE))
    audit(AUDIT_HOST_NOT, 'using a vulnerable configuration');
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);

var report = get_report(ver:ver, fix:fix);
security_report_v4(severity:SECURITY_HOLE, port:0, extra:report);