| code | #
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(58659);
script_version("1.35");
script_cvs_date("Date: 2018/11/15 20:50:31");
script_cve_id("CVE-2012-0158");
script_bugtraq_id(52911);
script_xref(name:"EDB-ID", value:"18780");
script_xref(name:"MSFT", value:"MS12-027");
script_xref(name:"MSKB", value:"983807");
script_xref(name:"MSKB", value:"983808");
script_xref(name:"MSKB", value:"983809");
script_xref(name:"MSKB", value:"2597112");
script_xref(name:"MSKB", value:"2598039");
script_xref(name:"MSKB", value:"2598041");
script_xref(name:"MSKB", value:"2641426");
script_xref(name:"MSKB", value:"2645025");
script_xref(name:"MSKB", value:"2647488");
script_xref(name:"MSKB", value:"2647490");
script_xref(name:"MSKB", value:"2655547");
script_xref(name:"MSKB", value:"2658674");
script_xref(name:"MSKB", value:"2658676");
script_xref(name:"MSKB", value:"2658677");
script_name(english:"MS12-027: Vulnerability in Windows Common Controls Could Allow Remote Code Execution (2664258)");
script_summary(english:"Checks for kill bit.");
script_set_attribute(attribute:"synopsis", value:
"The remote Windows host is affected by a remote code execution
vulnerability.");
script_set_attribute(attribute:"description", value:
"A memory corruption issue exists in Windows common controls,
specifically within the MSCOMCTL.TreeView, MSCOMCTL.ListView2,
MSCOMCTL.TreeView2, and MSCOMCTL.ListView controls component of
MSCOMCTL.OCX, due to improper sanitization of user-supplied input. An
unauthenticated, remote attacker can exploit this issue by convincing
a user to view a specially crafted web page, resulting in the
execution of arbitrary code.");
script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-027");
script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Office 2003, 2007 and
2010; Office 2003 Web Components; SQL Server 2000, 2005, 2005 Express
Edition, 2008, and 2008 R2; BizTalk Server 2002; Commerce Server 2002,
2007, 2009, and 2009 R2; Microsoft Visual FoxPro 8.0 and 9.0; and
Visual Basic 6.0 Runtime.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploit_framework_core", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'MS12-027 MSCOMCTL ActiveX Buffer Overflow');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
script_set_attribute(attribute:"canvas_package", value:'CANVAS');
script_set_attribute(attribute:"vuln_publication_date", value:"2012/04/10");
script_set_attribute(attribute:"patch_publication_date", value:"2012/04/10");
script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/11");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office_web_components");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sql_server");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_basic");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_foxpro");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:biztalk_server");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:commerce_server");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows : Microsoft Bulletins");
script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
script_dependencies(
"smb_hotfixes.nasl",
"ms_bulletin_checks_possible.nasl",
"mssql_version.nasl",
"commerce_server_installed.nasl",
"biztalk_server_installed.nasl",
"foxpro_installed.nasl",
"office_installed.nasl"
);
script_require_keys("SMB/MS_Bulletin_Checks/Possible");
script_require_ports(139, 445, "Host/patch_management_checks");
exit(0);
}
include('audit.inc');
include('smb_func.inc');
include('smb_hotfixes.inc');
include('smb_activex_func.inc');
include('smb_hotfixes_fcheck.inc');
include('smb_reg_query.inc');
include('misc_func.inc');
include('install_func.inc');
get_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');
bulletin = 'MS12-027';
kbs = make_list(
'983807',
'983808',
'983809',
'2597112',
'2598039',
'2598041',
'2641426',
'2645025',
'2647488',
'2647490',
'2655547',
'2658674',
'2658676',
'2658677'
);
if (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
get_kb_item_or_exit('SMB/Registry/Uninstall/Enumerated');
get_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);
if (activex_init() != ACX_OK) audit(AUDIT_FN_FAIL, 'activex_init');
clsids = make_list(
'{bdd1f04b-858b-11d1-b16a-00c0f0283628}',
'{996BF5E0-8044-4650-ADEB-0B013914E99C}',
'{C74190B6-8589-11d1-B16A-00C0F0283628}',
'{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}'
);
activex_report = NULL;
vuln = 0;
foreach clsid (clsids)
{
# Make sure the control is installed
file = activex_get_filename(clsid:clsid);
if (isnull(file) || !file) continue;
# Get its version
version = activex_get_fileversion(clsid:clsid);
if (!version) version = 'unknown';
if ((version != 'unknown' && ver_compare(ver:version, fix:'6.1.98.33') < 0) && activex_get_killbit(clsid:clsid) == 0)
{
vuln++;
if (!isnull(activex_report)) activex_report += '\n';
activex_report +=
'\n Class identifier : ' + clsid +
'\n Filename : ' + file +
'\n Installed version : ' + version;
}
}
activex_end();
analysis_svcs_installed = !isnull(get_kb_item('SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall/Microsoft SQL Server 2000 Analysis Services/DisplayName'));
sql_ver_list = get_kb_list("mssql/installs/*/SQLVersion");
analysispath = NULL;
vfp8_installed = !isnull(get_kb_item('SMB/VFP8.0/path'));
vfp9_installed = !isnull(get_kb_item('SMB/VFP9.0/path'));
commerce_edition = get_kb_item('SMB/commerce_server/productname');
vb6_installed = FALSE;
office_version = hotfix_check_office_version();
owc2003_installed = FALSE;
biztalk_editions = make_list();
biztalk_installs = get_installs(app_name:"BizTalk Server");
if (!empty_or_null(biztalk_installs[1]))
{
foreach biztalk_install (biztalk_installs[1])
biztalk_editions = make_list(biztalk_editions, biztalk_install['Product Name']);
}
uninst_array = get_kb_list('SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall/*/DisplayName');
foreach item (keys(uninst_array))
{
name = uninst_array[item];
if (name == 'Microsoft Office 2003 Web Components')
{
# determine if this is an 11.x or a 12.x
ver_key = item - "DisplayName";
ver_key += "DisplayVersion";
owc_ver = get_kb_item_or_exit(ver_key);
if (
# OWC 2003 SP3 (11.0.8173.0)
owc_ver =~ "^11\." &&
ver_compare(ver:owc_ver, fix:'11.0.8173.0', strict:FALSE) >= 0
)
owc2003_installed = TRUE;
else if (
# OWC 2003 for 2007 SP2 (12.0.6425.1000)
# OWC 2003 for 2007 SP3 (12.0.6607.1000); note this
# branch is vuln and there's no need for an upper
# boundary until (and if) an SP4 is released.
owc_ver =~ "^12\." &&
ver_compare(ver:owc_ver, fix:'12.0.6425.1000', strict:FALSE) >= 0
)
owc2003_for_office2007_installed = TRUE;
break;
}
}
if (vuln > 0 || analysis_svcs_installed)
{
registry_init();
hklm = registry_hive_connect(hive:HKEY_LOCAL_MACHINE, exit_on_fail:TRUE);
# If the ActiveX stuff looks unpatched, try to determine which KBs are missing
if (vuln > 0)
{
if (!isnull(get_registry_value(handle:hklm, item:"SOFTWARE\Microsoft\VisualStudio\6.0\Setup\Microsoft Visual Basic\ProductDir")))
vb6_installed = TRUE;
}
# determine if 32 or 64-bit office is installed. this value is reportedly whenever office 2010 is installed, even if outlook is not installed
if (office_version['14.0'])
office_bitness = get_registry_value(handle:hklm, item:"Software\Microsoft\Office\14.0\Outlook\Bitness");
# get the SQL Server 200 Analysis Services path if it looks like it's installed
if (analysis_svcs_installed)
{
analysispath = get_registry_value(handle:hklm, item:"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft SQL Server 2000 Analysis Services\InstallLocation");
if (analysispath)
analysispath += "\bin";
}
RegCloseKey(handle:hklm);
close_registry();
}
prod_info = NULL;
if (vuln)
{
activex_report = 'The following vulnerable controls do not have the kill bit set :\n' + activex_report;
prod_info = NULL;
if (office_version['11.0'] || owc2003_installed)
{
flag = TRUE;
if (office_version['11.0'])
{
sp = get_kb_item("SMB/Office/2003/SP");
if (!isnull(sp) && sp < 3) flag = FALSE; # < SP3 not reported
}
if (flag)
{
# KB923618 is Office 2003 SP3. KB2597112 will fail to install unless it's present, though it
# doesn't make it clear that the failure is due to a lack of SP3
prod_info +=
'\n\nProduct : Office 2003 / Office 2003 Web components' +
'\nMissing update : KB2597112 (prerequisite: KB923618)';
hotfix_add_report(bulletin:bulletin, kb:'2597112');
}
}
if (office_version['12.0'] || owc2003_for_office2007_installed)
{
# If Office 2003 Web Components is ver. 12.x a different KB applies
prod_info +=
'\n\nProduct : Office 2007 / Office 2003 Web Components' +
'\nMissing update : KB2598041 (prerequisite: KB937961)';
hotfix_add_report(bulletin:bulletin, kb:'2598041');
}
if (office_version['14.0'] && office_bitness != 'x64')
{
prod_info +=
'\n\nProduct : Office 2010' +
'\nMissing update : KB2598039';
hotfix_add_report(bulletin:bulletin, kb:'2598039');
}
if (vfp8_installed)
{
prod_info +=
'\n\nProduct : Visual FoxPro 8.0' +
'\nMissing update : KB2647488';
hotfix_add_report(bulletin:bulletin, kb:'2647488');
}
if (vfp9_installed)
{
prod_info +=
'\n\nProduct : Visual FoxPro 9.0' +
'\nMissing update : KB2647490';
hotfix_add_report(bulletin:bulletin, kb:'2647490');
}
if (vb6_installed)
{
# KB290887 is VB 6.0 Runtime SP6
prod_info +=
'\n\nProduct : Visual Basic 6.0 Runtime' +
'\nMissing update : KB2641426 (prerequisite: KB290887)';
hotfix_add_report(bulletin:bulletin, kb:'2641426');
}
if ('2009 R2' >< commerce_edition)
{
prod_info +=
'\n\nProduct : Commerce Server 2009 R2' +
'\nMissing update : KB2658676';
hotfix_add_report(bulletin:bulletin, kb:'2658676');
}
else if ('2009' >< commerce_edition)
{
prod_info +=
'\n\nProduct : Commerce Server 2009' +
'\nMissing update : KB2655547';
hotfix_add_report(bulletin:bulletin, kb:'2655547');
}
if ('2007' >< commerce_edition)
{
prod_info +=
'\n\nProduct : Commerce Server 2007' +
'\nMissing update : KB2658677';
hotfix_add_report(bulletin:bulletin, kb:'2658677');
}
if ('2002' >< commerce_edition)
{
prod_info +=
'\n\nProduct : Commerce Server 2002' +
'\nMissing update : KB2658674';
hotfix_add_report(bulletin:bulletin, kb:'2658674');
}
if (max_index(biztalk_editions) > 0)
{
foreach biztalk_edition (biztalk_editions)
{
if ('2002' >< biztalk_edition)
{
prod_info +=
'\n\nProduct : BizTalk Server 2002' +
'\nMissing update : KB2645025';
hotfix_add_report(bulletin:bulletin, kb:'2645025');
}
}
}
}
# the only other things to check are sql server 2000 and sql server 2000 analysis services.
# if neither are installed and the activex stuff is not vulnerable, there's no need to do any further testing
if (vuln == 0 && isnull(analysispath) && isnull(sql_ver_list)) exit(0, 'The host is not affected.');
if (!is_accessible_share()) exit(1, 'is_accessible_share() failed.');
# SQL Server 2000 Analysis Services
if (
analysispath &&
hotfix_is_vulnerable(path:analysispath, file:"Msmdadin.dll", version:"8.0.0.2302", min_version:"8.0.0.0", bulletin:bulletin, kb:"983807")
)
{
vuln++;
if (!isnull(activex_report))
{
prod_info +=
'\n\nProduct : SQL Server 2000 Analysis Services' +
'\nMissing update : KB983807';
}
}
foreach item (keys(sql_ver_list))
{
item -= 'mssql/installs/';
item -= '/SQLVersion';
sqlpath = item;
share = hotfix_path2share(path:sqlpath);
if (!is_accessible_share(share:share)) continue;
# SQL Server 2000
# GDR
if (hotfix_is_vulnerable(path:sqlpath, file:"Sqlservr.exe", version:"2000.80.2065.0", min_version:"2000.80.2000.0", bulletin:bulletin, kb:"983808"))
{
vuln++;
if (!isnull(activex_report))
{
prod_info +=
'\n\nProduct : SQL Server 2000' +
'\nMissing update : KB983808';
}
}
# QFE
else if(hotfix_is_vulnerable(path:sqlpath, file:"Sqlservr.exe", version:"2000.80.2301.0", min_version:"2000.80.2100.0", bulletin:bulletin, kb:"983809"))
{
vuln++;
if (!isnull(activex_report))
{
prod_info +=
'\n\nProduct : SQL Server 2000' +
'\nMissing update : KB983809';
}
}
}
if (vuln)
{
if (isnull(prod_info)) exit(0, "None of the Microsoft KBs applies even though at least one of the controls is in use, possibly from a third-party application.");
if (!isnull(activex_report))
{
activex_report +=
'\n\nNessus determined these controls are being used by the following applications :' +
prod_info;
if (hotfix_get_report())
hotfix_add_report('\n' + activex_report, bulletin:bulletin);
else
hotfix_add_report(activex_report, bulletin:bulletin);
}
set_kb_item(name:'SMB/Missing/' + bulletin, value:TRUE);
hotfix_security_hole();
hotfix_check_fversion_end();
exit(0);
}
else
{
hotfix_check_fversion_end();
audit(AUDIT_HOST_NOT, 'affected');
}
|