Juniper Networks Junos OS libc Vulnerability

# SPDX-FileCopyrightText: 2016 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/o:juniper:junos";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.106137");
  script_version("2023-07-21T05:05:22+0000");
  script_tag(name:"last_modification", value:"2023-07-21 05:05:22 +0000 (Fri, 21 Jul 2023)");
  script_tag(name:"creation_date", value:"2016-07-14 10:16:23 +0700 (Thu, 14 Jul 2016)");
  script_tag(name:"cvss_base", value:"4.9");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:N/C:C/I:N/A:N");

  script_tag(name:"qod_type", value:"package");

  script_tag(name:"solution_type", value:"VendorFix");

  script_cve_id("CVE-2009-1436");

  script_name("Juniper Networks Junos OS libc Vulnerability");

  script_category(ACT_GATHER_INFO);

  script_family("JunOS Local Security Checks");
  script_copyright("Copyright (C) 2016 Greenbone AG");
  script_dependencies("gb_juniper_junos_consolidation.nasl");
  script_mandatory_keys("juniper/junos/detected");

  script_tag(name:"summary", value:"Junos OS is prone to a vulnerability in libc.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable OS build is present on the target host.");

  script_tag(name:"insight", value:"On April 22nd, 2009 FreeBSD announced that the db interface in libc
does not properly initialize memory for Berkeley DB 1.85 database structures, which allows local users to
obtain sensitive information by reading a database file.

Junos OS operates on either FreeBSD 6.1 and earlier, or FreeBSD 10.1 and later depending on the version
of Junos OS.");

  script_tag(name:"impact", value:"A local attacker may obtain sensitive information.");

  script_tag(name:"affected", value:"Junos OS 12.1, 12.3, 13.2, 13.3, 14.1, 14.2 and 15.1");

  script_tag(name:"solution", value:"New builds of Junos OS software are available from Juniper.");

  script_xref(name:"URL", value:"http://kb.juniper.net/JSA10756");

  exit(0);
}

include("host_details.inc");
include("revisions-lib.inc");
include("version_func.inc");

if (!version = get_app_version(cpe: CPE, nofork: TRUE))
  exit(0);

if ((revcomp(a: version, b: "12.1X44-D55") < 0) &&
    (revcomp(a: version, b: "8.5") >= 0)) {
  report = report_fixed_ver(installed_version: version, fixed_version: "12.1X44-D55");
  security_message(port: 0, data: report);
  exit(0);
}

if (version =~ "^12") {
  if ((revcomp(a: version, b: "12.1X46-D40") < 0) &&
      (revcomp(a: version, b: "12.1X46") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "12.1X46-D40");
    security_message(port: 0, data: report);
    exit(0);
  }
  else if ((revcomp(a: version, b: "12.1X47-D25") < 0) &&
           (revcomp(a: version, b: "12.1X47") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "12.1X47-D25");
    security_message(port: 0, data: report);
    exit(0);
  }
  else if ((revcomp(a: version, b: "12.3R11") < 0) &&
           (revcomp(a: version, b: "12.3R") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "12.3R11");
    security_message(port: 0, data: report);
    exit(0);
  }
  else if ((revcomp(a: version, b: "12.3X48-D20") < 0) &&
           (revcomp(a: version, b: "12.3X48") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "12.3X48-D20");
    security_message(port: 0, data: report);
    exit(0);
  }
  else if ((revcomp(a: version, b: "12.3X50-D50") < 0) &&
           (revcomp(a: version, b: "12.3X50") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "12.3X50-D50");
    security_message(port: 0, data: report);
    exit(0);
  }
}

if (version =~ "^13") {
  if (revcomp(a: version, b: "13.2R8") < 0) {
    report = report_fixed_ver(installed_version: version, fixed_version: "13.2R8");
    security_message(port: 0, data: report);
    exit(0);
  }
  else if ((revcomp(a: version, b: "13.2X51-D40") < 0) &&
           (revcomp(a: version, b: "13.2X51") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "13.2X51-D40");
    security_message(port: 0, data: report);
    exit(0);
  }
  else if ((revcomp(a: version, b: "13.2X52-D30") < 0) &&
           (revcomp(a: version, b: "13.2X52") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "13.2X52-D30");
    security_message(port: 0, data: report);
    exit(0);
  }
  else if ((revcomp(a: version, b: "13.3R7") < 0) &&
           (revcomp(a: version, b: "13.3") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "13.3R7");
    security_message(port: 0, data: report);
    exit(0);
  }
}

if (version =~ "^14") {
  if (revcomp(a: version, b: "14.1R6") < 0) {
    report = report_fixed_ver(installed_version: version, fixed_version: "14.1R6");
    security_message(port: 0, data: report);
    exit(0);
  }
  else if ((revcomp(a: version, b: "14.1X53-D30") < 0) &&
           (revcomp(a: version, b: "14.1X53") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "14.1X53-D30");
    security_message(port: 0, data: report);
    exit(0);
  }
  else if ((revcomp(a: version, b: "14.2R4") < 0) &&
           (revcomp(a: version, b: "14.2") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "14.2R4");
    security_message(port: 0, data: report);
    exit(0);
  }
}

if (version =~ "^15") {
  if (revcomp(a: version, b: "15.1F3") < 0) {
    report = report_fixed_ver(installed_version: version, fixed_version: "15.1F3");
    security_message(port: 0, data: report);
    exit(0);
  }
  else if ((revcomp(a: version, b: "15.1R2") < 0) &&
           (revcomp(a: version, b: "15.1R") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "15.1R2");
    security_message(port: 0, data: report);
    exit(0);
  }
  else if ((revcomp(a: version, b: "15.1X49-D10") < 0) &&
           (revcomp(a: version, b: "15.1X49") >= 0)) {
    report = report_fixed_ver(installed_version: version, fixed_version: "15.1X49-D10");
    security_message(port: 0, data: report);
    exit(0);
  }
}

exit(99);