Juniper Networks Junos OS FTPS-Extensions Vulnerability

# Copyright (C) 2015 Greenbone Networks GmbH
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

CPE = "cpe:/o:juniper:junos";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.106042");
  script_version("2023-01-20T10:11:50+0000");
  script_tag(name:"last_modification", value:"2023-01-20 10:11:50 +0000 (Fri, 20 Jan 2023)");
  script_tag(name:"creation_date", value:"2015-11-23 09:29:53 +0700 (Mon, 23 Nov 2015)");
  script_tag(name:"cvss_base", value:"5.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2021-05-12 20:38:00 +0000 (Wed, 12 May 2021)");

  script_tag(name:"qod_type", value:"package");

  script_tag(name:"solution_type", value:"VendorFix");

  script_cve_id("CVE-2015-5361");

  script_name("Juniper Networks Junos OS FTPS-Extensions Vulnerability");

  script_category(ACT_GATHER_INFO);

  script_family("JunOS Local Security Checks");
  script_copyright("Copyright (C) 2015 Greenbone Networks GmbH");
  script_dependencies("gb_juniper_junos_consolidation.nasl");
  script_mandatory_keys("juniper/junos/detected", "juniper/junos/model");

  script_tag(name:"summary", value:"Junos OS is prone to a vulnerability in BFD daemon.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable OS build is present on the target host.");

  script_tag(name:"insight", value:"The ftps-extensions option is not intended or recommended
where the SRX secures the FTPS server, as the wide data channel session (gate) will allow the
FTPS client temporary access to all TCP ports on the FTPS server. The data session is associated
to the control channel and will be closed when the control channel session closes. Depending on
the configuration of the FTPS server, supporting load-balancer, and SRX inactivity-timeout values,
the server/load-balancer and SRX may keep the control channel open for an extended period of time,
allowing an FTPS client access for an equal duration.");

  script_tag(name:"impact", value:"An unauthenticated remote attacker may cause to expose TCP
ports for arbitrary data channels.");

  script_tag(name:"affected", value:"Junos OS 12.1, 12.3, 15.1");

  script_tag(name:"solution", value:"New builds of Junos OS software are available from Juniper. As a
workaround do not enable 'ftps-extentions' options if FTPS is not needed.");

  script_xref(name:"URL", value:"http://kb.juniper.net/JSA10706");

  exit(0);
}

include("host_details.inc");
include("revisions-lib.inc");

model = get_kb_item("juniper/junos/model");
if (!model || model !~ "^SRX")
  exit(99);

if (!version = get_app_version(cpe: CPE, nofork: TRUE))
  exit(0);

if (version =~ "^12") {
  if ((revcomp(a: version, b: "12.1X44-D55") < 0) &&
      (revcomp(a: version, b: "12.1X44") >= 0)) {
    security_message(port: 0, data: version);
    exit(0);
  }
  else if ((revcomp(a: version, b: "12.1X46-D40") < 0) &&
           (revcomp(a: version, b: "12.1X46") >= 0)) {
    security_message(port: 0, data: version);
    exit(0);
  }
  else if ((revcomp(a: version, b: "12.1X47-D25") < 0) &&
           (revcomp(a: version, b: "12.1X47") >= 0)) {
    security_message(port: 0, data: version);
    exit(0);
  }
  else if ((revcomp(a: version, b: "12.3X48-D15") < 0) &&
           (revcomp(a: version, b: "12.3X48") >= 0)) {
    security_message(port: 0, data: version);
    exit(0);
  }
}

if (version =~ "^13") {
  if (revcomp(a: version, b: "13.2R8") < 0) {
    security_message(port: 0, data: version);
    exit(0);
  }
  else if ((revcomp(a: version, b: "13.3R6") < 0) &&
           (revcomp(a: version, b: "13.3") >= 0)) {
    security_message(port: 0, data: version);
    exit(0);
  }
}

if (version =~ "^15") {
  if ((revcomp(a: version, b: "15.1X49-D10") < 0) &&
      (revcomp(a: version, b: "15.1X49") >= 0)) {
    security_message(port: 0, data: version);
    exit(0);
  }
}

exit(99);