Vulnerabilities > CVE-2009-0097 - Resource Management Errors vulnerability in Microsoft Visio 2002/2003/2007

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(35633);
  script_version("1.24");
  script_cvs_date("Date: 2018/11/15 20:50:30");

  script_cve_id("CVE-2009-0095", "CVE-2009-0096", "CVE-2009-0097");
  script_bugtraq_id(33659, 33660, 33661);
  script_xref(name:"MSFT", value:"MS09-005");
  script_xref(name:"MSKB", value:"955654");
  script_xref(name:"MSKB", value:"955655");
  script_xref(name:"MSKB", value:"957381");

  script_name(english:"MS09-005: Vulnerabilities in Microsoft Office Visio Could Allow Remote Code Execution (957634)");
  script_summary(english:"Determines the presence of update 957634");

  script_set_attribute(attribute:"synopsis", value:
"Arbitrary code can be executed on the remote host through Visio.");
  script_set_attribute(attribute:"description", value:
"The remote host contains a version of Microsoft Visio that is affected
by memory corruption and memory validation vulnerabilities triggered
when parsing specially crafted Visio files that could be be abused to
execute arbitrary code on the remote host.

To exploit this vulnerability, an attacker would need to send a
specially crafted Visio document to a user on the remote host and
trick him into opening it.");
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-005");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Microsoft Visio 2002, 2003
and 2007.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(399);

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/02/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/02/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/02/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visio");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}


include("smb_hotfixes_fcheck.inc");
include("smb_hotfixes.inc");
include("smb_func.inc");
include("audit.inc");

include("misc_func.inc");
get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS09-005';
kbs = make_list("955654", "955655", "957381");
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

vuln = 0;
share = '';
lastshare = '';
accessibleshare = FALSE;
visioinstalls = get_kb_list_or_exit("SMB/Office/Visio/*/VisioPath");
foreach install (keys(visioinstalls))
{
  if ("12.0" >< install || "11.0" >< install || "10.0" >< install)
  {
    path = visioinstalls[install];
  }
  else continue;

  share = hotfix_path2share(path:path);
  if (share != lastshare || !accessibleshare)
  {
    lastshare = share;
    if (is_accessible_share(share:share))
    {
      accessibleshare = TRUE;
    }
    else accessibleshare = FALSE;
  }
  if (accessibleshare)
  {
    if ("12.0" >< install)  # Visio 2007
    {
      if (hotfix_check_fversion(path:path, file:"Vislib.dll", version:"12.0.6336.5001", bulletin:bulletin, kb:"957381") == HCF_OLDER) vuln++;
    }
    else if ("11.0" >< install)  # Visio 2003
    {
      if (hotfix_check_fversion(path:path, file:"Visio11\Vislib.dll", version:"11.0.8223.0", bulletin:bulletin, kb:"955655") == HCF_OLDER) vuln++;
    }
    else if ("10.0" >< install)  # Visio 2002
    {
      if ( hotfix_check_fversion(path:path, file:"Visio10\Vislib.dll", version:"10.0.6885.4", bulletin:bulletin, kb:"955654") == HCF_OLDER) vuln++;
    }
  }
}
if (vuln)
{
  set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
  hotfix_security_hole();
  exit(0);
}
else audit(AUDIT_HOST_NOT, 'affected');

• name	Dragos Prisaca
  organization	Gideon Technologies, Inc.

• name	Shane Shaffer
  organization	G2, Inc.

• comment	Microsoft Office Visio 2002 SP2 is installed
  oval	oval:org.mitre.oval:def:692

• comment	Microsoft Office Visio 2003 is installed
  oval	oval:org.mitre.oval:def:1450