Vulnerabilities > CVE-2015-2520 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Microsoft Excel, Excel Viewer and Office Compatibility Pack

#TRUSTED 0d7d110ff3f696b01657b6e0d000e6284e8bb2843da739c19bb9d0db3298d72855949d9b067b956663fdaa766caf31851f200d20c297df781d690ee494e127d1d6b84e02d46b1dfd2156399d85de22c2533aeba03d5f89fc22d9a8ac1855edda1c2b1760875a03d29ce8d7d0c30136d98bd5414adcf9a3c289dd2433c2f3798893522c14473614809cd8545ed53da139adfc3ffd16232ba453954fe2f1ff20f6519fb074cc36bc1366e88e08bed3ce59f73a38f6041194b2d80adad826773f042d547993563b5d09969d6cb24f5774ffb8bc4d83d918c750717549929b087f704d29ce4607efe5bbd824a4fd274e63fa1d7a64f0362e003ca8a4232345a89b9f92291e1d0c2f9c0117ada61d6723f285849ee517be52900597fadc361b6dfb95f7e6007dae508f9a6a82028b312919961cb417c48c3281981e14203c69872392b7e74e90b38e38ee2b2d3dee428b8de900adc6ede3ec7f2e389df7bf9e0e4b5a1f6b1ff1a74a770e62ed18664fee25665af17624449caf03941efa90b78e492ea6ef54d3f3e8d1c87484103e4055e260b0ef95732ded10eccfc8bfb87c6154a427dc35bc5efd316e3cef14d9b793d1a80fd047c117d313028d129d1d998b34d1f6f72d9923e129206369f0edad6fc261048fd4335a4d8c23ee08005a3e1849a06072f5ae9853b33c06d0159aae7f52adf3a47440be4f82cbce7da4700bf299e2
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(85878);
  script_version("1.11");
  script_cvs_date("Date: 2019/11/22");

  script_cve_id("CVE-2015-2520", "CVE-2015-2523");
  script_bugtraq_id(76561, 76564);
  script_xref(name:"MSFT", value:"MS15-099");
  script_xref(name:"IAVA", value:"2015-A-0214");
  script_xref(name:"EDB-ID", value:"38214");
  script_xref(name:"EDB-ID", value:"38215");
  script_xref(name:"MSKB", value:"3088501");

  script_name(english:"MS15-099: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3089664) (Mac OS X)");
  script_summary(english:"Checks the version of Microsoft Office.");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Mac OS X host is affected by
multiple remote code execution vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Mac OS X host has a version of Microsoft Office installed
that is affected by multiple remote code execution vulnerabilities due
to improper handling of objects in memory. A remote attacker can
exploit these vulnerabilities by convincing a user to open a specially
crafted file in Microsoft Office, resulting in the execution of
arbitrary code in the context of the current user.");
  script_set_attribute(attribute:"see_also", value:"https://technet.microsoft.com/library/security/ms15-099");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released patches for Office for Mac 2011 and for Office
2016 for Mac.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/09/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/09/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office:2011:mac");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office:2016:mac");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:excel_for_mac:2011");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:excel_for_mac:2016");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("ssh_func.inc");
include("macosx_func.inc");


if(sshlib::get_support_level() >= sshlib::SSH_LIB_SUPPORTS_COMMANDS)
  enable_ssh_wrappers();
else disable_ssh_wrappers();

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

os = get_kb_item("Host/MacOSX/Version");
if (!os) audit(AUDIT_OS_NOT, "Mac OS X");

# Gather version info for Office 2011
info = '';
installs = make_array();
office_2011_found = FALSE;

prod = 'Office for Mac 2011';
plist = "/Applications/Microsoft Office 2011/Office/MicrosoftComponentPlugin.framework/Versions/14/Resources/Info.plist";
cmd =  'cat \'' + plist + '\' | ' +
  'grep -A 1 CFBundleShortVersionString | ' +
  'tail -n 1 | ' +
  'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\'';

version = exec_cmd(cmd:cmd);
if (version && version =~ "^[0-9]+\.")
{
  version = chomp(version);
  if (version !~ "^14\.")
    exit(1, "Failed to get the version for "+prod+" - '"+version+"'.");

  office_2011_found = TRUE;
  installs[prod] = version;

  ver = split(version, sep:'.', keep:FALSE);
  for (i=0; i<max_index(ver); i++)
    ver[i] = int(ver[i]);

  fixed_version = '14.5.5';
  fix = split(fixed_version, sep:'.', keep:FALSE);
  for (i=0; i<max_index(fix); i++)
    fix[i] = int(fix[i]);

  for (i=0; i<max_index(fix); i++)
    if ((ver[i] < fix[i]))
    {
      info +=
        '\n  Product           : ' + prod +
        '\n  Installed version : ' + version +
        '\n  Fixed version     : ' + fixed_version + '\n';
      break;
    }
    else if (ver[i] > fix[i])
      break;
}

# Checking for Office 2016. The same path for the overall install
# doesn't exist for 2016, so we need to check each app, as each one
# is listed as needing an update to 15.14.

apps = make_list(
         "Microsoft Outlook",
         "Microsoft Excel",
         "Microsoft Word",
         "Microsoft PowerPoint",
         "Microsoft OneNote");
fix_2016 = "15.14.0";

office_2016_found = FALSE;
foreach app (apps)
{
  plist = "/Applications/"+app+".app/Contents/Info.plist";
  cmd =
    'plutil -convert xml1 -o - \'' + plist + '\' | ' +
    'grep -A 1 CFBundleShortVersionString | ' +
    'tail -n 1 | ' +
    'sed \'s/.*string>\\(.*\\)<\\/string>.*/\\1/g\'';
  ver_2016 = exec_cmd(cmd:cmd);

  # check all of the applications
  if (!strlen(ver_2016))
    continue;

  office_2016_found = TRUE;
  if(ver_2016 =~ "^15\." &&
     ver_compare(ver:ver_2016, fix:fix_2016, strict:FALSE) < 0)
  {
    vuln[app] = ver_2016;
  }
}

if (office_2016_found)
{
    foreach app (keys(vuln))
    {
      info +=
        '\n  Product           : ' + app +
        '\n  Installed version : ' + vuln[app] +
        '\n  Fixed version     : ' + fix_2016 + '\n';
    }
}

# Report findings.
if (info)
{
  if (report_verbosity > 0) security_hole(port:0, extra:info);
  else security_hole(0);

  exit(0);
}
else
{
  msg = '';
  is = 'is';

  if (! office_2016_found && ! office_2011_found)
    audit(AUDIT_NOT_INST, "Office for Mac 2011/2016");
  if (office_2011_found)
  {
    msg = "Office for Mac 2011";
  }
  if (office_2016_found)
  {
    if (office_2011_found)
    {
      msg += " and ";
      is = "are";
    }
    msg += "Office 2016 for Mac";
  }

  exit(0, msg + " " + is + " not vulnerable.");
}