Vulnerabilities > CVE-2009-2495 - Information Exposure vulnerability in Microsoft Visual C++, Visual Studio and Visual Studio .Net

#
# (C) Tenable Network Security, Inc.
#


include('compat.inc');


if (description)
{
  script_id(40421);
  script_version("1.17");
  script_cvs_date("Date: 2018/11/15 20:50:28");

  script_cve_id('CVE-2009-0901', 'CVE-2009-2495', 'CVE-2009-2493');
  script_bugtraq_id(35845);

  script_name(english:'Shockwave Player < 11.5.0.601 Multiple Vulnerabilities (APSB09-11)');
  script_summary(english:'Checks version of Shockwave Player');

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host contains an Internet Explorer plugin which
uses a vulnerable version of the Microsoft Active Template Library
(ATL).");
  script_set_attribute(attribute:"description", value:
"The remote Windows host contains a version of Adobe's Shockwave Player
that is earlier than 11.5.0.601. Such versions were compiled against a
version of Microsoft's Active Template Library (ATL) that contained a
vulnerability. If an attacker can trick a user of the affected
software into opening such a file, this issue could be leveraged to
execute arbitrary code with the privileges of that user.");
  script_set_attribute(attribute:"see_also", value:"http://blogs.adobe.com/psirt/2009/07/impact_of_microsoft_atl_vulner.html/");
  script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/bulletins/apsb09-11.html");
  script_set_attribute(attribute:"solution", value:
"Uninstall the Internet Explorer version of Shockwave Player version
11.5.0.600 and earlier, restart the system, and then install version
11.5.0.601 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(94, 200, 264);

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/07/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:shockwave_player");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:'Windows');

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies('smb_hotfixes.nasl');
  script_require_keys('SMB/Registry/Enumerated');
  script_require_ports(139, 445);

  exit(0);
}

include('global_settings.inc');
include('smb_func.inc');
include("audit.inc");


# Connect to the appropriate share.
if (!get_kb_item('SMB/Registry/Enumerated')) exit(0, 'SMB/Registry/Enumerated KB item is missing.');
name    =  kb_smb_name();
port    =  kb_smb_transport();

login   =  kb_smb_login();
pass    =  kb_smb_password();
domain  =  kb_smb_domain();



if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');
rc = NetUseAdd(login:login, password:pass, domain:domain, share:'IPC$');
if (rc != 1)
{
  NetUseDel();
  exit(1, 'Can not connect to IPC$ share.');
}

# Connect to remote registry.
hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
if (isnull(hklm))
{
  NetUseDel();
  exit(1, 'Can not connect to remote registry.');
}

# Check whether it's installed.
variants = make_array();

# - check for the ActiveX control.
clsids = make_list(
  '{4DB2E429-B905-479A-9EFF-F7CBD9FD52DE}',
  '{233C1507-6A77-46A4-9443-F871F945D258}',
  '{166B1BCA-3F9C-11CF-8075-444553540000}'     # used in versions <= 10.x.
);
foreach clsid (clsids)
{
  key = 'SOFTWARE\\Classes\\CLSID\\' + clsid + '\\InprocServer32';
  key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
  if (!isnull(key_h))
  {
    item = RegQueryValue(handle:key_h, item:NULL);
    if (!isnull(item))
    {
      file = item[1];
      variants[file] = 'ActiveX';
    }
    RegCloseKey(handle:key_h);
  }
}

RegCloseKey(handle:hklm);
if (max_index(keys(variants)) == 0)
{
  NetUseDel();
  exit(0, 'Shockwave Player for Internet Explorer is not installed.');
}

# Determine the version of each instance found.
files = make_array();
info = '';

foreach file (keys(variants))
{
  # Don't report again if the name differs only in its case.
  if (files[tolower(file)]++) continue;

  variant = variants[file];

  share = ereg_replace(pattern:'^([A-Za-z]):.*', replace:'\\1$', string:file);
  file2 =  ereg_replace(pattern:'^[A-Za-z]:(.*)', replace:'\\1', string:file);
  NetUseDel(close:FALSE);

  rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
  if (rc != 1)
  {
    NetUseDel();
    exit(1, 'Can not connect to '+share+' share.');
  }

  fh = CreateFile(
    file:file2,
    desired_access:GENERIC_READ,
    file_attributes:FILE_ATTRIBUTE_NORMAL,
    share_mode:FILE_SHARE_READ,
      create_disposition:OPEN_EXISTING
  );
  if (!isnull(fh))
  {
    ver = GetFileVersion(handle:fh);
    CloseFile(handle:fh);

    if (
      isnull(ver) ||
      (ver[0] == 0 && ver[1] == 0 && ver[2] == 0 && ver[3] == 0)
    )
    {
      NetUseDel();
      exit(1, "Failed to get the file version from '"+file+"'.");
    }

    if (
      ver[0] < 11 ||
      (
        ver[0] == 11 &&
        (
          ver[1] < 5 ||
          (ver[1] == 5 && ver[2] == 0 && ver[3] < 601)
        )
      )
    )
    {
      version = string(ver[0], '.', ver[1], '.', ver[2], '.', ver[3]);

      if (variant == 'ActiveX')
      {
        info += '  - ActiveX control (for Internet Explorer) :\n';
      }

      info += '    ' + file + ', ' + version + '\n';
    }
  }
  NetUseDel(close:FALSE);
}
NetUseDel();


if (!info) exit(0, 'No vulnerable installs of Shockwave Player were found.');

if (report_verbosity > 0)
{
  # nb: each vulnerable instance adds 2 lines to 'info'.
  if (max_index(split(info)) > 2)
    shck = 's';
  else shck = '';

  report = string(
    '\n',
    'Nessus has identified the following vulnerable instance', shck, ' of Shockwave\n',
    'Player for Internet Explorer installed on the remote host :\n',
    '\n',
    info
  );
  security_hole(port:get_kb_item('SMB/transport'), extra:report);
}
else security_hole(get_kb_item('SMB/transport'));

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(40435);
  script_version("1.32");
  script_cvs_date("Date: 2018/11/15 20:50:30");

  script_cve_id("CVE-2009-0901", "CVE-2009-2493", "CVE-2009-2495");
  script_bugtraq_id(35828, 35830, 35832);
  script_xref(name:"MSFT", value:"MS09-035");
  script_xref(name:"MSKB", value:"973544");
  script_xref(name:"MSKB", value:"973551");
  script_xref(name:"MSKB", value:"973552");
  script_xref(name:"MSKB", value:"973675");
  script_xref(name:"IAVB", value:"2009-B-0033");
  script_xref(name:"CERT", value:"456745");

  script_name(english:"MS09-035: Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706)");
  script_summary(english:"Checks for Visual Studio / Visual C++ patches");

  script_set_attribute(attribute:"synopsis", value:
"Arbitrary code can be executed on the remote host through Microsoft
Active Template Library.");
  script_set_attribute(attribute:"description", value:
"The remote Windows host contains a version of the Microsoft Active
Template Library (ATL), included as part of Visual Studio or Visual
C++, that is affected by multiple vulnerabilities :

  - On systems with components and controls installed that
    were built using Visual Studio ATL, an issue in the ATL
    headers could allow an attacker to force VariantClear
    to be called on a VARIANT that has not been correctly
    initialized and, by supplying a corrupt stream, to
    execute arbitrary code. (CVE-2009-0901)

  - On systems with components and controls installed that
    were built using Visual Studio ATL, unsafe usage of
    OleLoadFromStream could allow instantiation of
    arbitrary objects that can bypass related security
    policy, such as kill bits within Internet Explorer.
    (CVE-2009-2493)

  - On systems with components and controls installed that
    were built using Visual Studio ATL, an issue in the ATL
    headers could allow a string to be read without a
    terminating NULL character, which could lead to
    disclosure of information in memory. (CVE-2009-2495)");
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-035");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Visual Studio .NET 2003,
Visual Studio 2005 and 2008, as well as Visual C++ 2005 and 2008.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(94, 200, 264);

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/07/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_studio");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_studio_.net");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_c++");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}

include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_reg_query.inc");
include("misc_func.inc");
include("audit.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
get_kb_item_or_exit("SMB/Registry/Uninstall/Enumerated");

bulletin = 'MS09-035';
kbs = make_list("973544", "973551", "973552", "973675");
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);


if (!get_kb_item("SMB/WindowsVersion")) exit(1, "SMB/WindowsVersion KB item is missing.");


rootfile = hotfix_get_systemroot();
if (!rootfile) exit(1, "Can't get system root.");

commonfiles = hotfix_get_commonfilesdir();

MAX_RECURSE = 3;


port    =  kb_smb_transport();
login   =  kb_smb_login();
pass    =  kb_smb_password();
domain  =  kb_smb_domain();

if(! smb_session_init()) audit(AUDIT_FN_FAIL, "smb_session_init");
hcf_init = TRUE;

function _list_dir(basedir, level, dir_pat, file_pat)
{
  local_var contents, ret, subdirs, subsub;

  # nb: limit how deep we'll recurse.
  if (level > MAX_RECURSE) return NULL;

  subdirs = NULL;
  if (isnull(dir_pat)) dir_pat = "";
  ret = FindFirstFile(pattern:basedir + "\*" + dir_pat + "*");

  contents = make_list();
  while (!isnull(ret[1]))
  {
    if (file_pat && ereg(pattern:file_pat, string:ret[1], icase:TRUE))
      contents = make_list(contents, basedir+"\"+ret[1]);

    subsub = NULL;
    if ("." != ret[1] && ".." != ret[1] && level <= MAX_RECURSE)
      subsub  = _list_dir(basedir:basedir+"\"+ret[1], level:level+1, file_pat:file_pat);
    if (!isnull(subsub))
    {
      if (isnull(subdirs)) subdirs = make_list(subsub);
      else subdirs = make_list(subdirs, subsub);
    }
    ret = FindNextFile(handle:ret);
  }

  if (isnull(subdirs)) return contents;
  else return make_list(contents, subdirs);
}


# Returns the file version as a string, either from the KB or by
# calling GetFileVersion(). Assumes we're already connected to the
# correct share.
function get_file_version()
{
  local_var fh, file, ver, version;

  if (isnull(_FCT_ANON_ARGS[0])) return NULL;

  file = _FCT_ANON_ARGS[0];
  version = get_kb_item("SMB/FileVersions"+tolower(str_replace(string:file, find:"\", replace:"/")));
  if (isnull(version))
  {
    fh = CreateFile(
      file:file,
      desired_access:GENERIC_READ,
      file_attributes:FILE_ATTRIBUTE_NORMAL,
      share_mode:FILE_SHARE_READ,
      create_disposition:OPEN_EXISTING
    );
    if (!isnull(fh))
    {
      ver = GetFileVersion(handle:fh);
      CloseFile(handle:fh);
      if (!isnull(ver))
      {
        version = string(ver[0], ".", ver[1], ".", ver[2], ".", ver[3]);
        set_kb_item(
          name:"SMB/FileVersions"+tolower(str_replace(string:file, find:"\", replace:"/")),
          value:version
        );
      }
    }
  }
  return version;
}



#######################################################################
# Check VC++ Redistributables.
#######################################################################
installs = make_array();

# - Check if the redistributable is known to be installed; otherwise,
#   we'll generate a false positive against Visual Studio.
list = get_kb_list("SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall/*/DisplayName");
if (!isnull(list))
{
  foreach name (keys(list))
  {
    prod = list[name];
    if (prod && ereg(pattern:"^Microsoft Visual C\+\+ 200[58] Redistributable", string:prod, icase:TRUE))
    {
      installs[tolower(prod)]++;
    }
  }
}

if (max_index(keys(installs)))
{
  share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:rootfile);
  if (!is_accessible_share(share:share)) exit(1, "Can't access '"+share+"' share.");

  rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
  if (rc != 1)
  {
    NetUseDel();
    exit(1, "Can't access '"+share+"' share.");
  }

  fixed = make_array();
  probs = make_array();
  kbs = make_array();
  fixed_versions = make_array();
  fversions = make_array();
  prodfiles = make_array();

  winsxs = ereg_replace(pattern:"^[A-Za-z]:(.*)", replace:"\1\WinSxS", string:rootfile);
  files = _list_dir(basedir:winsxs, level:0, dir_pat:"microsoft.vc?0.atl", file_pat:"^atl(80|90)\.dll$");
  if (!isnull(files))
  {
    foreach file (files)
    {
      if (ereg(pattern:"Microsoft\.VC80\.ATL", string:file, icase:TRUE))
      {
        prod = "Visual C++ 2005 SP1 Redistributable Package";
        fixed_versions[prod] = "8.0.50727.4053";
        prodfiles[prod] = "atl80.dll";
        kbs[prod] = '973544';
      }
      else if (ereg(pattern:"Microsoft\.VC90\.ATL.+_9\.0\.[0-2][0-9]+", string:file, icase:TRUE))
      {
        prod = "Visual C++ 2008 Redistributable Package";
        fixed_versions[prod] = "9.0.21022.218";
        prodfiles[prod] = "atl90.dll";
        kbs[prod] = '973551';
      }
      else if (ereg(pattern:"Microsoft\.VC90\.ATL.+_9\.0\.3[0-9]+", string:file, icase:TRUE))
      {
        prod = "Visual C++ 2008 SP1 Redistributable Package";
        fixed_versions[prod] = "9.0.30729.4148";
        prodfiles[prod] = "atl90.dll";
        kbs[prod] = '973552';
      }
      else continue;

      installed = FALSE;
      foreach key (keys(installs))
      {
        if (
          (" 2005 " >< prod && " 2005 " >< key) ||
          (
            " 2008 " >< prod && " 2008 " >< key &&
            (
              ereg(pattern:" 9\.0\.[0-2][0-9]+", string:key) ||
              (" SP1 " >< prod && ereg(pattern:" 9\.0\.3[0-9]+", string:key))
            )
          )
        )
        {
          installed = TRUE;
          break;
        }
      }
      if (!installed) continue;

      if (isnull(fixed[prod]) || fixed[prod] == 0)
      {
        version = get_file_version(file);
        fversions[prod] = version;
        if (!isnull(version))
        {
          if (version == fixed_versions[prod])
          {
            fixed[prod]++;
            if (prod == "Visual C++ 2008 SP1 Redistributable Package")
            {
              fixed["Visual C++ 2008 Redistributable Package"]++;
              probs[prod] = 0;
            }
            continue;
          }

          ver = split(version, sep:'.', keep:FALSE);
          for (i=0; i<max_index(ver); i++)
            ver[i] = int(ver[i]);

          fix = split(fixed_versions[prod], sep:'.', keep:FALSE);
          for (i=0; i<max_index(fix); i++)
            fix[i] = int(fix[i]);

          # Flag it if it's older or flag the fix if it's fixed.
          for (i=0; i<max_index(ver); i++)
            if ((ver[i] < fix[i]))
            {
              fixed[prod] = 0;
              probs[prod]++;
              break;
            }
            else if (ver[i] > fix[i])
            {
              fixed[prod]++;
              probs[prod] = 0;
              if (prod == "Visual C++ 2008 SP1 Redistributable Package")
              {
                fixed["Visual C++ 2008 Redistributable Package"]++;
                probs[prod] = 0;
              }
              break;
            }
          }
      }
    }
  }
  NetUseDel(close:FALSE);

  # Report and exit if there's a problem.
  info = "";
  s = 0;
  foreach prod (keys(probs))
  {
    if (!fixed[prod]) s++;
  }
  if (s)
  {
    set_kb_item(name:'SMB/Missing/MS09-035', value:TRUE);

    if (s > 1) s = 's have';
    else s = ' has';
    info =
      '\n  The following Visual C++ Redistributable Package' + s + ' not' +
      '\n  been patched : \n';
    hotfix_add_report(info);
    foreach prod (keys(probs))
    {
      if (fixed[prod]) continue;

      info =
        '\n  Product           : ' + prod +
        '\n  File              : ' + prodfiles[prod] +
        '\n  Installed version : ' + fversions[prod] +
        '\n  Fixed version     : ' + fixed_versions[prod] + '\n';
      hotfix_add_report(info, bulletin:bulletin, kb:kbs[prod]);
    }
    hotfix_security_hole();
    exit(0);
  }
}



#######################################################################
# Check Visual Studio installs.
#######################################################################
# - identify VCROOT for each install.
installs = make_array();

rc = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$");
if (rc != 1)
{
  NetUseDel();
  exit(1, "Can't connect to IPC$ share.");
}

hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
if (isnull(hklm))
{
  NetUseDel();
  exit(1, "Can't connect to remote registry.");
}

key = "SOFTWARE\Microsoft\VisualStudio";
subkeys = get_registry_subkeys(handle:hklm, key:key, wow:TRUE);
if (!isnull(subkeys))
{
  if (report_paranoia < 2) pat = '^(7\\.1|8\\.0|9\\.0)$';
  else pat = '^[0-9]\\.[0-9]+$';
  foreach node (keys(subkeys))
  {
    key = node;
    foreach subkey (subkeys[node])
    {
      if (ereg(pattern:pat, string:subkey))
      {
        key2 = key + '\\' + subkey;
        path = get_registry_value(handle:hklm, item:key2 + "\InstallDir");
        if (!isnull(path))
        {
          path = ereg_replace(pattern:'^"(.+)"$', replace:"\1", string:path);
          vcroot = ereg_replace(pattern:"^(.+)\\Common7\\IDE\\$", replace:"\1", string:path, icase:TRUE);
          if (vcroot >< path) installs[subkey] = vcroot;
        }
      }
    }
  }
}
RegCloseKey(handle:hklm);
NetUseDel(close:FALSE);

# - locate possibly-affected files.
atl_files = make_list();

foreach ver (keys(installs))
{
  if (ver =~ "^[89]\.")
  {
    vcroot = installs[ver];

    share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:vcroot);
    rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
    if (rc != 1)
    {
      NetUseDel();
      exit(1, "Can't access '"+share+"' share.");
    }

    path =  ereg_replace(pattern:"^[A-Za-z]:(.*)", replace:"\1", string:vcroot);
    files = _list_dir(basedir:path+"\VC\redist", level:0, file_pat:"^atl(80|90)\.dll$");
    if (!isnull(files))
    {
      foreach file (files)
      {
        atl_files = make_list(atl_files, (share-'$')+':'+file);
      }
    }
  }
  else
  {
    if (report_paranoia < 2) pat = "^atl(71|80|90)\.dll$";
    else pat = "^atl[0-9][0-9]\.dll$";

    basedirs = make_list(
      rootfile+"\System32",
      commonfiles+"\Microsoft Shared\Help",
      commonfiles+"\Microsoft Shared\VSA"
    );

    foreach basedir (basedirs)
    {
      share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:basedir);
      rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
      if (rc != 1)
      {
        NetUseDel();
        exit(1, "Can't access '"+share+"' share.");
      }
      basedir = ereg_replace(pattern:"^[A-Za-z]:(.*)", replace:"\1", string:basedir);

      if (ereg(pattern:"\System32$", string:basedir, icase:TRUE))
        files = _list_dir(basedir:basedir, level:MAX_RECURSE, file_pat:pat);
      else
        files = _list_dir(basedir:basedir, level:0, file_pat:pat);
      if (!isnull(files))
      {
        foreach file (files)
        {
            atl_files = make_list(atl_files, (share-'$')+':'+file);
        }
      }
      NetUseDel(close:FALSE);
    }
  }
}
NetUseDel(close:FALSE);


# - check each file.
vuln = 0;

foreach atl (atl_files)
{
  match = eregmatch(pattern:"^(.+)\\(atl[0-9]+\.dll)$", string:atl, icase:TRUE);
  if (match)
  {
    path = match[1];
    file = match[2];

    if (
      hotfix_check_fversion(file:file, version:"9.0.30729.4148", min_version:"9.0.30000.0", path:path, bulletin:bulletin, kb:'973675') == HCF_OLDER ||
      hotfix_check_fversion(file:file, version:"9.0.21022.218",  min_version:"9.0.0.0",     path:path, bulletin:bulletin, kb:'973674') == HCF_OLDER ||
      hotfix_check_fversion(file:file, version:"8.0.50727.4053", min_version:"8.0.0.0",     path:path, bulletin:bulletin, kb:'971090') == HCF_OLDER ||
      hotfix_check_fversion(file:file, version:"7.10.6101.0",                               path:path, bulletin:bulletin, kb:'971089') == HCF_OLDER
    ) vuln++;
  }
}

if (vuln)
{
  set_kb_item(name:"SMB/Missing/MS09-035", value:TRUE);
  hotfix_security_hole();

  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  exit(0, "The host is not affected");
}

#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(42116);
  script_version("1.30");
  script_cvs_date("Date: 2018/11/15 20:50:30");

  script_cve_id("CVE-2009-0901", "CVE-2009-2493", "CVE-2009-2495");
  script_bugtraq_id(35828, 35830, 35832);
  script_xref(name:"MSFT", value:"MS09-060");
  script_xref(name:"MSKB", value:"972363");
  script_xref(name:"MSKB", value:"973709");
  script_xref(name:"CERT", value:"456745");

  script_name(english:"MS09-060: Vulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office Could Allow Remote Code Execution (973965)");
  script_summary(english:"Checks version of various files");

  script_set_attribute(attribute:"synopsis", value:
"Arbitrary code can be executed on the remote host through Microsoft
Office ActiveX controls.");
  script_set_attribute(attribute:"description", value:
"One or more ActiveX controls included in Microsoft Outlook or Visio
and installed on the remote Windows host was compiled with a version
of Microsoft Active Template Library (ATL) that is affected by
potentially several vulnerabilities :

  - An issue in the ATL headers could allow an attacker to
    force VariantClear to be called on a VARIANT that has
    not been correctly initialized and, by supplying a
    corrupt stream, to execute arbitrary code.
    (CVE-2009-0901)

  - Unsafe usage of 'OleLoadFromStream' could allow
    instantiation of arbitrary objects which can bypass
    related security policy, such as kill bits within
    Internet Explorer. (CVE-2009-2493)

  - An attacker who is able to run a malicious component or
    control built using Visual Studio ATL can, by
    manipulating a string with no terminating NULL byte,
    read extra data beyond the end of the string and thus
    disclose information in memory. (CVE-2009-2495)");
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-060");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Microsoft Outlook 2002,
2003, and 2007 as well as Visio Viewer 2007.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(94, 200, 264);

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/10/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/10/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}



include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("audit.inc");

include("misc_func.inc");
get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS09-060';
kbs = make_list("972363", "973709");
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

if (!get_kb_item("SMB/Registry/Enumerated")) exit(1, "KB 'SMB/Registry/Enumerated' not set to TRUE.");


# Determine the install path for Vision Viewer 2007.
visio_viewer_path = NULL;

port    =  kb_smb_transport();
login   =  kb_smb_login();
pass    =  kb_smb_password();
domain  =  kb_smb_domain();

if(! smb_session_init()) audit(AUDIT_FN_FAIL, "smb_session_init");

hcf_init = TRUE;
rc = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$");
if (rc != 1)
{
  NetUseDel();
  audit(AUDIT_SHARE_FAIL, "IPC$");
}

# Connect to remote registry.
hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
if (isnull(hklm))
{
  NetUseDel();
  audit(AUDIT_REG_FAIL);
}

key = "SOFTWARE\Microsoft\Office";
key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
if (!isnull(key_h))
{
  value = RegQueryValue(handle:key_h, item:"InstallRoot");
  if (value) visio_viewer_path = value[1];

  RegCloseKey(handle:key_h);
}
if (isnull(visio_viewer_path))
{
  key = "SOFTWARE\Microsoft\Office\12.0\Common\InstallRoot";
  key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
  if (!isnull(key_h))
  {
    value = RegQueryValue(handle:key_h, item:"Path");
    if (value) visio_viewer_path = value[1];

    RegCloseKey(handle:key_h);
  }
}
RegCloseKey(handle:hklm);
NetUseDel(close:FALSE);


vuln = 0;

share = '';
lastshare = '';
accessibleshare = FALSE;
#Office
outlook_paths = get_kb_list("SMB/Office/Outlook/*/Path");
if (!isnull(outlook_paths))
{
  foreach install (keys(outlook_paths))
  {
    outlook_path = outlook_paths[install];
    share = hotfix_path2share(path:outlook_path);

    if (share != lastshare || !accessibleshare)
    {
      lastshare = share;
      if (is_accessible_share(share:share))
      {
        accessibleshare = TRUE;
      }
      else accessibleshare = FALSE;
    }
    if (accessibleshare)
    {
      # Outlook 2007
      if ("12.0" >< install)
      {
        if (hotfix_check_fversion(path:outlook_path, file:"Outlmime.dll", version:"12.0.6514.5000", min_version:"12.0.0.0", bulletin:bulletin, kb:'972363') == HCF_OLDER) vuln++;
      }
      # Outlook 2003
      else if ("11.0" >< install)
      {
        if (hotfix_check_fversion(path:outlook_path, file:"Outllib.dll", version:"11.0.8313.0", min_version:"11.0.0.0", bulletin:bulletin, kb:'973705') == HCF_OLDER) vuln++;
      }
      # Outlook 2002
      else if ("10.0" >< install)
      {
        if (hotfix_check_fversion(path:outlook_path, file:"Outllib.dll", version:"10.0.6856.0", min_version:"10.0.0.0", bulletin:bulletin, kb:'973702') == HCF_OLDER) vuln++;
      }
    }
  }
}


# Visio
#
# - Visio Viewer 2007.
if (visio_viewer_path)
{
  share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:visio_viewer_path);
  if (!is_accessible_share(share:share)) exit(1, "Can't access '"+share+"' share.");

  if (
    hotfix_check_fversion(path:visio_viewer_path, file:"Vpreview.exe", version:"12.0.6513.5000", min_version:"12.0.0.0", bulletin:bulletin, kb:'973709') == HCF_OLDER ||
    hotfix_check_fversion(path:visio_viewer_path, file:"Vviewdwg.dll", version:"12.0.6500.5000", min_version:"12.0.0.0", bulletin:bulletin, kb:'973709') == HCF_OLDER ||
    hotfix_check_fversion(path:visio_viewer_path, file:"vviewer.dll",  version:"12.0.6513.5000", min_version:"12.0.0.0", bulletin:bulletin, kb:'973709') == HCF_OLDER
  ) vuln++;
}
# - nb: we don't check for Visio Viewer 2002 and 2003 because the
#       vulnerabilities are mitigated by applying MS09-034, and we
#       do have a check for that.


if (vuln)
{
  set_kb_item(name:"SMB/Missing/MS09-060", value:TRUE);
  hotfix_security_hole();

  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}

• name	Dragos Prisaca
  organization	Gideon Technologies, Inc.

• name	Mike Lah
  organization	The MITRE Corporation

• name	Mike Lah
  organization	The MITRE Corporation

• name	Mike Lah
  organization	The MITRE Corporation

• name	Mike Lah
  organization	The MITRE Corporation

• name	J. Daniel Brown
  organization	DTCC

• name	Dragos Prisaca
  organization	Symantec Corporation

• name	Dragos Prisaca
  organization	Symantec Corporation

• name	Dragos Prisaca
  organization	Symantec Corporation

• name	Dragos Prisaca
  organization	Symantec Corporation

• name	Dragos Prisaca
  organization	Symantec Corporation

• name	Dragos Prisaca
  organization	G2, Inc.

• name	Maria Kedovskaya
  organization	ALTX-SOFT

• name	Maria Mikhno
  organization	ALTX-SOFT

• comment	Microsoft Visual Studio .NET 2003 SP1 is installed
  oval	oval:org.mitre.oval:def:168

• comment	Microsoft Visual Studio 2005 Service Pack 1 is installed
  oval	oval:org.mitre.oval:def:6401

• comment	Microsoft Visual Studio 2008 is installed
  oval	oval:org.mitre.oval:def:5401

• comment	Microsoft Visual Studio 2008 Service Pack 1 is installed
  oval	oval:org.mitre.oval:def:6205

• name	Dragos Prisaca
  organization	Gideon Technologies, Inc.

• name	J. Daniel Brown
  organization	DTCC

• name	Shane Shaffer
  organization	G2, Inc.

• comment	Microsoft Outlook 2002 is installed
  oval	oval:org.mitre.oval:def:5179

• comment	Microsoft Outlook 2003 is installed
  oval	oval:org.mitre.oval:def:5505

• comment	Microsoft Outlook 2007 is installed
  oval	oval:org.mitre.oval:def:5352

• comment	Microsoft Visio Viewer 2002 is installed
  oval	oval:org.mitre.oval:def:6500

• comment	Microsoft Office Visio Viewer 2003 is installed
  oval	oval:org.mitre.oval:def:6420

• comment	Microsoft Office Visio Viewer 2007 is installed
  oval	oval:org.mitre.oval:def:6128

• name	J. Daniel Brown
  organization	DTCC

• name	Mike Lah
  organization	The MITRE Corporation

• name	Mike Lah
  organization	The MITRE Corporation

• name	Mike Lah
  organization	The MITRE Corporation

• name	Mike Lah
  organization	The MITRE Corporation

• name	Dragos Prisaca
  organization	Symantec Corporation

• name	Dragos Prisaca
  organization	Symantec Corporation

• name	Dragos Prisaca
  organization	Symantec Corporation

• name	Dragos Prisaca
  organization	Symantec Corporation

• name	Dragos Prisaca
  organization	Symantec Corporation

• name	Shane Shaffer
  organization	G2, Inc.

• name	Dragos Prisaca
  organization	G2, Inc.

• name	Maria Kedovskaya
  organization	ALTX-SOFT

• name	Maria Mikhno
  organization	ALTX-SOFT

• name	Maria Mikhno
  organization	ALTX-SOFT

• comment	Microsoft Outlook 2002 is installed
  oval	oval:org.mitre.oval:def:5179

• comment	Microsoft Outlook 2003 is installed
  oval	oval:org.mitre.oval:def:5505

• comment	Microsoft Outlook 2007 is installed
  oval	oval:org.mitre.oval:def:5352

• comment	Microsoft Visio Viewer 2002 is installed
  oval	oval:org.mitre.oval:def:6500

• comment	Microsoft Office Visio Viewer 2003 is installed
  oval	oval:org.mitre.oval:def:6420

• comment	Microsoft Office Visio Viewer 2007 is installed
  oval	oval:org.mitre.oval:def:6128

• comment	Microsoft Visual Studio .NET 2003 SP1 is installed
  oval	oval:org.mitre.oval:def:168

• comment	Microsoft Visual Studio 2005 Service Pack 1 is installed
  oval	oval:org.mitre.oval:def:6401

• comment	Microsoft Visual Studio 2008 is installed
  oval	oval:org.mitre.oval:def:5401

• comment	Microsoft Visual Studio 2008 Service Pack 1 is installed
  oval	oval:org.mitre.oval:def:6205

• comment	Microsoft Visual C++ 2005 Redistributable Package is installed
  oval	oval:org.mitre.oval:def:29007

• comment	Microsoft Visual C++ 2008 Redistributable Package is installed
  oval	oval:org.mitre.oval:def:28587