Juniper Networks Junos OS FPC DoS Vulnerability (JSA10655)

# SPDX-FileCopyrightText: 2014 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/o:juniper:junos";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.105927");
  script_cve_id("CVE-2014-6380");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_version("2023-08-04T16:09:15+0000");

  script_tag(name:"qod_type", value:"package");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Juniper Networks Junos OS FPC DoS Vulnerability (JSA10655)");

  script_xref(name:"URL", value:"http://kb.juniper.net/JSA10655");
  script_xref(name:"URL", value:"http://www.securityfocus.com/bid/70369");

  script_tag(name:"summary", value:"Juniper Networks Junos OS is prone to a denial of service (DoS)
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable OS build is present on the target host.");

  script_tag(name:"insight", value:"Traffic between the RE and transit interfaces is carried over an
  internal network between the PFEs and REs. Some REs use em interfaces (usually, em0 and em1) to
  connect to this network. Receipt of a carefully crafted set of fragmented packets, destined to the
  router, can cause the em driver to become permanently blocked when trying to formulate a reply.");

  script_tag(name:"impact", value:"An attacker can cause the RE to be unable to communicate over the
  private network that connects the FPCs and REs eventually causing all FPCs to go offline and stay
  offline. Systems with redundant REs will failover, but would then be subject to the same issue.");

  script_tag(name:"affected", value:"Junos OS 11.4, 12.1, 12.2, 12.3, 13.1, 13.2.

  This issue can affect any product or platform utilizing an em interface for communications,
  including M, T, MX, SRX5400/5600/5800, EX, QFX, PTX Series, and MAG-Series CMC.

  J Series and SRX Series models not listed above do not utilize the em driver, and are therefore
  not affected by this issue.");

  script_tag(name:"solution", value:"New builds of Junos OS software are available from Juniper.

  As a workaround filter fragmented packets destined to the router.");

  script_tag(name:"last_modification", value:"2023-08-04 16:09:15 +0000 (Fri, 04 Aug 2023)");
  script_tag(name:"creation_date", value:"2014-11-20 11:17:18 +0700 (Thu, 20 Nov 2014)");

  script_category(ACT_GATHER_INFO);
  script_family("JunOS Local Security Checks");
  script_copyright("Copyright (C) 2014 Greenbone AG");
  script_dependencies("gb_juniper_junos_consolidation.nasl");
  script_mandatory_keys("juniper/junos/detected", "juniper/junos/model");

  exit(0);
}

include("host_details.inc");
include("revisions-lib.inc");

if (!model = get_kb_item("juniper/junos/model"))
  exit(0);

if (model !~ "^(SRX5(4|6|8)00|M|T|MX|EX|QFX|PTX|MAG|CMC)")
  exit(99);

if (!version = get_app_version(cpe: CPE, nofork: TRUE))
  exit(0);

if (revcomp(a:version, b:"11.4R11") < 0) {
  security_message(port:0, data:version);
  exit(0);
}

if (version =~ "^12") {
  if (revcomp(a:version, b:"12.1R9") < 0) {
    security_message(port:0, data:version);
    exit(0);
  }
  if ((revcomp(a:version, b:"12.1X44-D30") < 0) &&
    (revcomp(a:version, b:"12.1X45") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.1X45-D20") < 0) &&
           (revcomp(a:version, b:"12.1X45") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.1X46-D15") < 0) &&
           (revcomp(a:version, b:"12.1X46") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.1X47-D10") < 0) &&
           (revcomp(a:version, b:"12.1X47") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.2R8") < 0) &&
           (revcomp(a:version, b:"12.2") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.2X50-D70") < 0) &&
           (revcomp(a:version, b:"12.2X50") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"12.3R6") < 0) &&
           (revcomp(a:version, b:"12.3") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
}

if (version =~ "^13") {
  if (revcomp(a:version, b:"13.1R4") < 0) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.1X49-D55") < 0) &&
           (revcomp(a:version, b:"13.1X49") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.1X50-D30") < 0) &&
           (revcomp(a:version, b:"13.1X50") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.2R4") < 0) &&
           (revcomp(a:version, b:"13.2") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.2X50-D20") < 0) &&
           (revcomp(a:version, b:"13.2X50") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.2X51-D15") < 0) &&
           (revcomp(a:version, b:"13.2X51") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
  else if ((revcomp(a:version, b:"13.2X52-D15") < 0) &&
           (revcomp(a:version, b:"13.2X52") >= 0)) {
    security_message(port:0, data:version);
    exit(0);
  }
}

exit(99);