| code | #
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(81265);
script_version("1.13");
script_cvs_date("Date: 2019/11/25");
script_cve_id("CVE-2015-0063", "CVE-2015-0064", "CVE-2015-0065");
script_bugtraq_id(72460, 72463, 72465);
script_xref(name:"MSFT", value:"MS15-012");
script_xref(name:"MSKB", value:"2920788");
script_xref(name:"MSKB", value:"2956099");
script_xref(name:"MSKB", value:"2956073");
script_xref(name:"MSKB", value:"2956058");
script_xref(name:"MSKB", value:"2956081");
script_xref(name:"MSKB", value:"2956066");
script_xref(name:"MSKB", value:"2920753");
script_xref(name:"MSKB", value:"2956092");
script_xref(name:"MSKB", value:"2920791");
script_xref(name:"MSKB", value:"2956097");
script_xref(name:"MSKB", value:"2956098");
script_xref(name:"MSKB", value:"2920810");
script_xref(name:"MSKB", value:"2956070");
script_xref(name:"IAVA", value:"2015-A-0037");
script_name(english:"MS15-012: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3032328)");
script_summary(english:"Checks Word / Office Web Apps version.");
script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple remote code execution
vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The remote Windows host has a version of Microsoft Office, Office
Compatibility Pack, Microsoft Word Viewer, Microsoft Excel Viewer,
SharePoint Server, or Microsoft Office Web Apps that is affected by
one or more remote code execution vulnerabilities due to Microsoft
Word and Microsoft Excel improperly handling objects in memory. A
remote attacker can exploit these vulnerabilities by convincing a user
to open a specially crafted Office file, resulting in execution of
arbitrary code in the context of the current user.");
script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-012");
script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Office 2007, 2010, 2013,
Office Compatibility Pack, Microsoft Word Viewer, Microsoft Excel
Viewer, SharePoint Server, and Office Web Apps.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2015/02/10");
script_set_attribute(attribute:"patch_publication_date", value:"2015/02/10");
script_set_attribute(attribute:"plugin_publication_date", value:"2015/02/10");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:word_viewer");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:excel_viewer");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office_compatibility_pack");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_server");
script_set_attribute(attribute:"stig_severity", value:"II");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows : Microsoft Bulletins");
script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("office_installed.nasl", "microsoft_sharepoint_installed.nbin", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
script_require_keys("SMB/MS_Bulletin_Checks/Possible");
script_require_ports(139, 445, "Host/patch_management_checks");
exit(0);
}
include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_reg_query.inc");
include("misc_func.inc");
global_var bulletin, vuln;
function get_ver()
{
local_var fh, path, rc, share, ver;
path = _FCT_ANON_ARGS[0];
share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:path);
rc = NetUseAdd(share:share);
if (rc != 1)
{
NetUseDel();
audit(AUDIT_SHARE_FAIL, share);
}
ver = NULL;
path = ereg_replace(string:path, pattern:"^[A-Za-z]:(.*)", replace:'\\1\\');
fh = CreateFile(
file : path,
desired_access : GENERIC_READ,
file_attributes : FILE_ATTRIBUTE_NORMAL,
share_mode : FILE_SHARE_READ,
create_disposition : OPEN_EXISTING
);
if (!isnull(fh))
{
ver = GetFileVersion(handle:fh);
ver = join(ver, sep:".");
CloseFile(handle:fh);
}
NetUseDel(close:FALSE);
return ver;
}
function check_vuln(fix, kb, name, path, ver)
{
local_var info;
if (isnull(ver))
ver = get_ver(path);
if (isnull(ver) || ver_compare(ver:ver, fix:fix, strict:FALSE) >= 0)
return 0;
info =
'\n Product : ' + name +
'\n Path : ' + path +
'\n Installed version : ' + ver +
'\n Fixed version : ' + fix +
'\n';
hotfix_add_report(info, bulletin:bulletin, kb:kb);
vuln = TRUE;
}
get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
# Get path information for Windows.
windir = hotfix_get_systemroot();
if (isnull(windir)) exit(1, "Failed to determine the location of %windir%.");
bulletin = 'MS15-012';
kbs = make_list(
2920788, # Excel 2007
2956099, # Word 2007
2956073, # Office 2010 (proofing tools)
2956058, # Office 2010
2956081, # Excel 2010
2956066, # Word 2010
2920753, # Excel 2013
2956092, # Word Viewer
2920791, # Excel Viewer
2956097, # Office Compatibility Pack
2956098, # Office Compatibility Pack
2920810, # Word Automation Services
2956070 # Web Apps 2010
);
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
get_kb_item_or_exit("SMB/Registry/Enumerated", exit_code:1);
# Connect to the registry.
registry_init();
hklm = registry_hive_connect(hive:HKEY_LOCAL_MACHINE, exit_on_fail:TRUE);
# Get path information for SharePoint Server 2010.
sps_2010_path = get_registry_value(
handle : hklm,
item : "SOFTWARE\Microsoft\Office Server\14.0\InstallPath"
);
# Close connection to registry.
RegCloseKey(handle:hklm);
close_registry(close:FALSE);
# Get path information for Office Web Apps.
owa_2010_path = sps_2010_path;
######################################################################
# Office Web Apps 2010 SP1 / SP2
######################################################################
if (owa_2010_path)
{
check_vuln(
name : "Office Web Apps 2010",
kb : "2956070",
path : owa_2010_path + "WebServices\ConversionService\Bin\Converter\sword.dll",
fix : "14.0.7143.5000"
);
}
######################################################################
# SharePoint Server 2010 SP2
######################################################################
if (sps_2010_path)
{
check_vuln(
name : "Office SharePoint Server 2010",
kb : "2920810",
path : sps_2010_path + "WebServices\WordServer\Core\sword.dll",
fix : "14.0.7143.5000"
);
}
# Excel
kb = "";
installs = get_kb_list("SMB/Office/Excel/*/ProductPath");
if (!isnull(installs))
{
foreach install (keys(installs))
{
version = install - 'SMB/Office/Excel/' - '/ProductPath';
path = installs[install];
info = "";
# Excel 2013
if (version =~ "^15\." &&
ver_compare(ver:version, fix:"15.0.4693.1000") < 0)
{
office_sp = get_kb_item("SMB/Office/2013/SP");
if (!isnull(office_sp) && (office_sp == 0 || office_sp == 1))
{
info =
'\n Product : Excel 2013' +
'\n File : ' + path +
'\n Installed version : ' + version +
'\n Fixed version : 15.0.4693.1000' + '\n';
kb = "2920753";
}
}
# Excel 2010
if (version =~ "^14\." &&
ver_compare(ver:version, fix:'14.0.7143.5000') < 0)
{
office_sp = get_kb_item('SMB/Office/2010/SP');
if (!isnull(office_sp) && office_sp == 2)
{
info =
'\n Product : Excel 2010' +
'\n File : ' + path +
'\n Installed version : ' + version +
'\n Fixed version : 14.0.7143.5000\n';
kb = '2956081';
}
}
# Excel 2007
if (version =~ "^12\." &&
ver_compare(ver:version, fix:'12.0.6715.5000') < 0)
{
office_sp = get_kb_item("SMB/Office/2007/SP");
if (!isnull(office_sp) && (office_sp == 3))
{
info =
'\n Product : Excel 2007' +
'\n File : ' + path +
'\n Installed version : ' + version +
'\n Fixed version : 12.0.6715.5000\n';
kb = '2920788';
}
}
if (info)
{
hotfix_add_report(info, bulletin:bulletin, kb:kb);
vuln = TRUE;
}
}
}
# Word
kb = "";
installs = get_kb_list("SMB/Office/Word/*/ProductPath");
if (!isnull(installs))
{
foreach install (keys(installs))
{
version = install - 'SMB/Office/Word/' - '/ProductPath';
path = installs[install];
info = "";
# Word 2010 SP2
if (version =~ "^14\." &&
ver_compare(ver:version, fix:'14.0.7143.5000') < 0)
{
office_sp = get_kb_item("SMB/Office/2010/SP");
if (!isnull(office_sp) && (office_sp == 2))
{
info =
'\n Product : Word 2010' +
'\n File : ' + path +
'\n Installed version : ' + version +
'\n Fixed version : 14.0.7143.5000' + '\n';
kb = "2956066";
}
}
# Word 2007 SP3
if (version =~ "^12\." &&
ver_compare(ver:version, fix:'12.0.6715.5000') < 0)
{
office_sp = get_kb_item("SMB/Office/2007/SP");
if (!isnull(office_sp) && office_sp == 3)
{
info =
'\n Product : Word 2007 SP3' +
'\n File : ' + path +
'\n Installed version : ' + version +
'\n Fixed version : 12.0.6715.5000' + '\n';
kb = "2956099";
}
}
if (info)
{
hotfix_add_report(info, bulletin:bulletin, kb:kb);
vuln = TRUE;
}
}
}
# Word Viewer
installs = get_kb_list("SMB/Office/WordViewer/*/ProductPath");
if (!isnull(installs))
{
foreach install (keys(installs))
{
info = "";
version = install - 'SMB/Office/WordViewer/' - '/ProductPath';
path = installs[install];
if (isnull(path)) path = "n/a";
if (ver_compare(ver:version, fix:'11.0.8415.0') < 0)
{
info =
'\n Product : Word Viewer' +
'\n File : ' + path +
'\n Installed version : ' + version +
'\n Fixed version : 11.0.8415.0' + '\n';
kb = "2956092";
}
if (info)
{
hotfix_add_report(info, bulletin:bulletin, kb:kb);
vuln = TRUE;
break;
}
}
}
# Excel Viewer
installs = get_kb_list("SMB/Office/ExcelViewer/*/ProductPath");
if (!isnull(installs))
{
foreach install (keys(installs))
{
info = "";
version = install - 'SMB/Office/ExcelViewer/' - '/ProductPath';
path = installs[install];
if (isnull(path)) path = "n/a";
if (ver_compare(ver:version, fix:'12.0.6716.5000') < 0)
{
info =
'\n Product : Excel Viewer' +
'\n File : ' + path +
'\n Installed version : ' + version +
'\n Fixed version : 12.0.6716.5000' + '\n';
kb = "2920791";
}
if (info)
{
hotfix_add_report(info, bulletin:bulletin, kb:kb);
vuln = TRUE;
break;
}
}
}
# Ensure Office is installed
office_vers = hotfix_check_office_version();
if (!isnull(office_vers))
{
# Ensure we can get common files directory
commonfiles = hotfix_get_officecommonfilesdir(officever:"14.0");
if (commonfiles)
{
# Ensure share is accessible
share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:commonfiles);
if (is_accessible_share(share:share))
{
# Office 2010
if (office_vers["14.0"])
{
office_sp = get_kb_item("SMB/Office/2010/SP");
if (!isnull(office_sp) && office_sp == 2)
{
path = get_kb_item("SMB/Office/Word/14.0/Path");
if (!path) path = get_kb_item("SMB/Office/Excel/14.0/Path");
if (!path) path = get_kb_item("SMB/Office/PowerPoint/14.0/Path");
if (path)
{
old_report = hotfix_get_report();
check_file = "Wwlib.dll";
if (hotfix_check_fversion(path:path, file:check_file, version:"14.0.7143.5000", min_version:"14.0.0.0") == HCF_OLDER)
{
file = ereg_replace(pattern:"^[A-Za-z]:(.*)", string:path, replace:"\1\" + check_file);
kb_name = "SMB/FileVersions/"+tolower(share-'$')+tolower(str_replace(string:file, find:"\", replace:"/"));
kb_name = str_replace(find:"//", replace:"/", string:kb_name);
version = get_kb_item(kb_name);
info =
'\n Product : Microsoft Office 2010' +
'\n File : ' + path + '\\' + check_file +
'\n Installed version : ' + version +
'\n Fixed version : 14.0.7143.5000' + '\n';
hcf_report = '';
hotfix_add_report(old_report + info, bulletin:bulletin, kb:"2956058");
vuln = TRUE;
}
old_report = hotfix_get_report();
check_file = "mshy7en.dll";
if (hotfix_check_fversion(path:path, file:check_file, version:"14.0.7005.1000", min_version:"14.0.0.0") == HCF_OLDER)
{
file = ereg_replace(pattern:"^[A-Za-z]:(.*)", string:path, replace:"\1\" + check_file);
kb_name = "SMB/FileVersions/"+tolower(share-'$')+tolower(str_replace(string:file, find:"\", replace:"/"));
kb_name = str_replace(find:"//", replace:"/", string:kb_name);
version = get_kb_item(kb_name);
info =
'\n Product : Microsoft Office 2010' +
'\n File : ' + path + '\\' + check_file +
'\n Installed version : ' + version +
'\n Fixed version : 14.0.7005.1000' + '\n';
hcf_report = '';
hotfix_add_report(old_report + info, bulletin:bulletin, kb:"2956073");
vuln = TRUE;
}
}
}
}
}
}
}
version = '';
installs = get_kb_list("SMB/Office/WordCnv/*/ProductPath");
if (!isnull(installs))
{
foreach install (keys(installs))
{
version = install - 'SMB/Office/WordCnv/' - '/ProductPath';
path = installs[install];
if (!isnull(path))
{
share = hotfix_path2share(path:path);
if (!is_accessible_share(share:share))
audit(AUDIT_SHARE_FAIL, share);
path = path - '\\Wordconv.exe';
old_report = hotfix_get_report();
check_file = "wordcnv.dll";
if (hotfix_check_fversion(path:path, file:check_file, version:"12.0.6715.5000", min_version:"12.0.0.0") == HCF_OLDER)
{
file = ereg_replace(pattern:"^[A-Za-z]:(.*)", string:path, replace:"\1\" + check_file);
kb_name = "SMB/FileVersions/"+tolower(share-'$')+tolower(str_replace(string:file, find:"\", replace:"/"));
kb_name = ereg_replace(pattern:"//"+check_file, replace:"/"+check_file, string:kb_name);
version = get_kb_item(kb_name);
info =
'\n Product : Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats' +
'\n File : ' + path + '\\' + check_file +
'\n Installed version : ' + version +
'\n Fixed version : 12.0.6715.5000' + '\n';
hcf_report = '';
hotfix_add_report(old_report + info, bulletin:bulletin, kb:"2956098");
vuln = TRUE;
}
}
}
}
if (!version)
{
# Additional check if registry key is missing
path = hotfix_get_officecommonfilesdir(officever:"12.0") + "\Microsoft Office\Office12";
kb = "2956098";
if (
hotfix_is_vulnerable(file:"wordcnv.dll", version:"12.0.6715.5000", min_version:"12.0.0.0", path:path, bulletin:bulletin, kb:kb)
) vuln = TRUE;
}
version = '';
installs = get_kb_list("SMB/Office/ExcelCnv/*/ProductPath");
if (!isnull(installs))
{
foreach install (keys(installs))
{
version = install - 'SMB/Office/ExcelCnv/' - '/ProductPath';
path = installs[install];
if (isnull(path)) path = "n/a";
if (ver_compare(ver:version, fix:'12.0.6715.5000') < 0)
{
info =
'\n Product : 2007 Office system and the Office Compatibility Pack' +
'\n File : '+ path +
'\n Installed version : '+ version +
'\n Fixed version : 12.0.6715.5000' +
'\n';
hotfix_add_report(info, bulletin:bulletin, kb:"2956097");
}
}
}
if (!version)
{
# Additional check if registry key is missing
path = get_kb_item("SMB/Office/Excel/12.0/Path");
if (path)
{
kb = "2956097";
if (hotfix_is_vulnerable(file:"excelcnv.exe", version:"12.0.6715.5000", min_version:"12.0.0.0", path:path, bulletin:bulletin, kb:kb)
) vuln = TRUE;
}
}
if (vuln)
{
set_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
hotfix_security_hole();
hotfix_check_fversion_end();
exit(0);
}
else
{
hotfix_check_fversion_end();
audit(AUDIT_HOST_NOT, 'affected');
}
|