Juniper Networks Junos OS RSVP DoS Vulnerability (JSA10652)

# SPDX-FileCopyrightText: 2014 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/o:juniper:junos";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.105926");
  script_cve_id("CVE-2014-6378");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_version("2026-04-24T06:23:04+0000");

  script_tag(name:"qod_type", value:"package");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Juniper Networks Junos OS RSVP DoS Vulnerability (JSA10652)");

  script_xref(name:"URL", value:"http://kb.juniper.net/JSA10652");
  script_xref(name:"URL", value:"http://www.securityfocus.com/bid/70363");

  script_tag(name:"summary", value:"Juniper Networks Junos OS is prone to a denial of service (DoS)
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable OS build is present on the target host.");

  script_tag(name:"insight", value:"Receipt of a crafted or malformed RSVP packet may cause the
  routing protocol daemon to hang or crash. This issue only occurs during processing of RSVP PATH
  messages. If RSVP is not enabled on an interface, then the issue cannot be triggered via that
  interface.");

  script_tag(name:"impact", value:"An attacker can cause the routing protocol daemon to hang or
  crash. When rpd is unavailable, routing updates cannot be processed which can lead to an extended
  network outage.");

  script_tag(name:"solution", value:"New builds of Junos OS software are available from Juniper.

  As a workaround enable RSVP only on trusted interfaces as required for MPLS.");

  script_tag(name:"affected", value:"Junos OS 11.4, 12.1, 12.2, 12.3, 13.1, 13.2 with support for
  RSVP enabled.");

  script_tag(name:"last_modification", value:"2026-04-24 06:23:04 +0000 (Fri, 24 Apr 2026)");
  script_tag(name:"creation_date", value:"2014-11-20 11:16:04 +0700 (Thu, 20 Nov 2014)");

  script_category(ACT_GATHER_INFO);
  script_family("JunOS Local Security Checks");
  script_copyright("Copyright (C) 2014 Greenbone AG");
  script_dependencies("gb_juniper_junos_consolidation.nasl");
  script_mandatory_keys("juniper/junos/detected");

  exit(0);
}

include("host_details.inc");
include("revisions-lib.inc");

if (!version = get_app_version(cpe: CPE, nofork: TRUE))
  exit(0);

if (revcomp(a:version, b:"11.4R12-S4") < 0) {
  security_message(port:0, data:version);
  exit(0);
}

if (version =~ "^12") {
  if (revcomp(a:version, b:"12.1X44-D35") < 0) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.1X45-D30") < 0) &&
           (revcomp(a:version, b:"12.1X45") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.1X46-D25") < 0) &&
           (revcomp(a:version, b:"12.1X46") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.1X47-D10") < 0) &&
           (revcomp(a:version, b:"12.1X47") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.2R9") < 0) &&
           (revcomp(a:version, b:"12.2") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.2X50-D70") < 0) &&
           (revcomp(a:version, b:"12.2X50") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.3R7") < 0) &&
           (revcomp(a:version, b:"12.3") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
}

if (version =~ "^13") {
  if (revcomp(a:version, b:"13.1R4-S3") < 0) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.1X49-D55") < 0) &&
           (revcomp(a:version, b:"13.1X49") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.1X50-D30") < 0) &&
           (revcomp(a:version, b:"13.1X50") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.2R5") < 0) &&
           (revcomp(a:version, b:"13.2") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.2X50-D20") < 0) &&
           (revcomp(a:version, b:"13.2X50") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.2X51-D26") < 0) &&
           (revcomp(a:version, b:"13.2X51") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.2X52-D15") < 0) &&
           (revcomp(a:version, b:"13.2X52") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
}

exit(99);