Juniper Junos OS Vulnerability (JSA79184)

#TRUSTED 4ddd7d9aa3442503d2239d80b6bd310df6d9e3a4d124f3ac36926964e327cc960c868beff52489aa333c6ac76d41a3c3fd9cb93d0473a730e59d7194e90cc6da3b0ff4b0cbf85f50446a13c605267c809bc6e532b2be993dc8982fb97821d7c0701aef3a6d8e5bf12b5f5eb7cad59dff048fd1fc15573565edd5bdd03ca7ab05d55226f58a982c51116f930417b34e3564fd8779231601f13104ee96666520a0bda9f18bf91da0ad988a2b23ba5dc66e40739d3c72041d688e5b49f6d3f0dde03e4cea0041db624d59d4567adc1566ba889b407a29736c7ed80e5b306d0465bf1b5d414ef9c4ac9e69ee607396da5e74ccc7d4cb9708cd6d6d963439fbafabfa85581d9f29a62ce59dec61f55efb122be8bb529ab723c0e6cf2a7a137dc217b4287ec03f4f1e65d8df2e10e901b4b0f49beae9d624ab9f7364885a35a261d394cffa05899ed57b98ef8782cdc4faf3632964fa086ff1f432f754d137c648968afa54715e01d8c66ad70c5d700bf7a81be0ffc11389469e6746009b6d01eb39baa25229dd47b69fd39655819346cb9f932e95a2935b8b18881c358cb71b23c89aca04230462fba548a4071328fb4d4b2c4546c79d81e5c960e0efe3cf41e1c956db3d9c159a813db7ef8770c51850adc9b3d4aa1f5ec492d3d0ca6cc3c42abc389ea795fcd510f02205ea62a5121d4d76a22eac74f0f32bcc052a77eed76f3ff3
#TRUST-RSA-SHA256 32712d1a12550cfb4d95f9e4aa9a890fdb2a14f98f37472a3eab5a9523347a6289ffc2408740520551a245dc28a1499072bf54134a5fe3e0d68df365de1362256e8b89480b69b1e8fd997cfb45258016fc71fcb770a1786a70a1ad74928cd2a03825f5b20d65201b0c3d46c4bb3049812d08cc9442f08fd2b069409ea91aaea6b9c891052d2536f15eb613c3107fc4ac032b68c428e89a7392f80d24e3c7b5ac898ac70b2b9a7e86b7820ce98c9cc2143a2a9fb7074f2edf4d874cca9cf2f282b9806744385505d92ee8f64d12c81c0ca2e11ab691d938b82b3b0e836e678926ac96ce19731a631df8238c1db67135ba079c316fbece13d5471756e34d057142deb91967c3241ca323f314e7709feb30576211c3f566f82c9b974a9f79c58a46304c29c62d935d16a667541138948e73dc78cc8e4dbf3509ef88a2d0b5e035bd3bea3774f1d89822ebc6489740c6a3da58342576b1f8019512de62c46888c49a7bc70e57161c17e7ca502e9d329f90f3169cc531b4d8372e9e6c08dcec2a960a65a36a62eeaf695b431af7c9a1897169be21ee8386469cc4ec009ad94627fa6cf148a22679ecf0742c40367e8d1cb34002b502f9b6f6a2d4b5dfac005234642eff1cde40303a62466c57136bb795c0d1e9f50823f226aa60ee78829fcd1432e378e93a9da9d560ef1cb965d22cf10c99018e2dbe54bbc831ad49f3e8c13bf695
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(195169);
  script_version("1.0");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/08");

  script_cve_id("CVE-2024-30386");
  script_xref(name:"JSA", value:"JSA79184");
  script_xref(name:"IAVA", value:"2024-A-0232");

  script_name(english:"Juniper Junos OS Vulnerability (JSA79184)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA79184
advisory.

  - A Use-After-Free vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS
    and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause l2ald to crash leading to a
    Denial-of-Service (DoS). (CVE-2024-30386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2024-04-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-In-a-EVPN-VXLAN-scenario-state-changes-on-adjacent-systems-can-cause-an-l2ald-process-crash-CVE-2024-30386
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d6d626db");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA79184");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:H/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-30386");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/04/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/08");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');


var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'20.4R3-S8'},
  {'min_ver':'0.0', 'fixed_ver':'20.4R3-S8-EVO'},
  {'min_ver':'21.2', 'fixed_ver':'21.2R3-S6'},
  {'min_ver':'21.2', 'fixed_ver':'21.2R3-S6-EVO'},
  {'min_ver':'21.3', 'fixed_ver':'21.3R3-S5'},
  {'min_ver':'21.3', 'fixed_ver':'21.3R3-S5-EVO'},
  {'min_ver':'21.4', 'fixed_ver':'21.4R3-S4'},
  {'min_ver':'21.4', 'fixed_ver':'21.4R3-S4-EVO'},
  {'min_ver':'22.1', 'fixed_ver':'22.1R3-S3'},
  {'min_ver':'22.1', 'fixed_ver':'22.1R3-S3-EVO'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S1'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S1-EVO'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R3'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R3-EVO'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R2'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R2-EVO'}
];

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);

var override = TRUE;
# https://www.juniper.net/documentation/us/en/software/junos/evpn-vxlan/topics/task/evpn-routing-instance-vlan-based-configuring.html
var buf = junos_command_kb_item(cmd:'show configuration | display set');
if (buf)
{
  override = FALSE;
  if (!junos_check_config(buf:buf, pattern:"^set routing-instances .* vxlan vni [0-9]+"))
    audit(AUDIT_OS_CONF_NOT_VULN, 'Junos OS');
}

junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_WARNING);