Vulnerabilities > CVE-2017-8534 - Information Exposure vulnerability in Microsoft Office, Windows 7 and Windows Server 2008

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
microsoft
CWE-200
nessus
NVD
Published: 2017-06-15
Updated: 2017-06-26

Summary

Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows improper disclosure of memory contents, aka "Windows Uniscribe Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0282, CVE-2017-0284, and CVE-2017-0285.

Vulnerable Configurations

Part Description Count
Application
Microsoft
2
OS
Microsoft
3

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_JUN_OFFICE.NASL
    descriptionThe Microsoft Office application installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple remote code execution vulnerabilities exist in Microsoft Office due to improper validation of input before loading dynamic link library (DLL) files. An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted Office document, to execute arbitrary code in the context of the current user. (CVE-2017-0260. CVE-2017-8506) - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0284, CVE-2017-0285, CVE-2017-8534) - Multiple remote code execution vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to execute arbitrary code in the context of the current user. (CVE-2017-0283, CVE-2017-8528) - Multiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0286, CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533) - A remote code execution vulnerability exists in Microsoft Windows due to improper parsing of PDF files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted PDF file, to execute arbitrary code in the context of the current user. (CVE-2017-0292) - A remote code execution vulnerability exists in Microsoft Outlook due to improper parsing of email messages. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted email message, to execute arbitrary code in the context of the current user. (CVE-2017-8507) - A security bypass vulnerability exists in Microsoft Outlook due to improper parsing of file formats. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted Office document, to bypass security feature protections. (CVE-2017-8508) - Multiple remote code execution vulnerabilities exist in Microsoft Office due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted Office document, to execute arbitrary code in the context of the current user. (CVE-2017-8509, CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, CVE-2017-8550) - A remote code execution vulnerability exists in Microsoft PowerPoint due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute arbitrary code in the context of the current user. (CVE-2017-8513) - A remote code execution vulnerability exists in the Windows font library due to improper handling of embedded fonts. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website or open a specially crafted Microsoft document, to execute arbitrary code in the context of the current user. (CVE-2017-8527)
    last seen2020-06-01
    modified2020-06-02
    plugin id100782
    published2017-06-14
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100782
    titleSecurity Update for Microsoft Office Products (June 2017)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(100782);
  script_version("1.13");
  script_cvs_date("Date: 2019/11/22");

  script_cve_id(
    "CVE-2017-0260",
    "CVE-2017-0282",
    "CVE-2017-0283",
    "CVE-2017-0284",
    "CVE-2017-0285",
    "CVE-2017-0286",
    "CVE-2017-0287",
    "CVE-2017-0288",
    "CVE-2017-0289",
    "CVE-2017-0292",
    "CVE-2017-8506",
    "CVE-2017-8507",
    "CVE-2017-8508",
    "CVE-2017-8509",
    "CVE-2017-8510",
    "CVE-2017-8511",
    "CVE-2017-8512",
    "CVE-2017-8513",
    "CVE-2017-8527",
    "CVE-2017-8528",
    "CVE-2017-8531",
    "CVE-2017-8532",
    "CVE-2017-8533",
    "CVE-2017-8534",
    "CVE-2017-8550"
  );
  script_bugtraq_id(
    98810,
    98811,
    98812,
    98813,
    98815,
    98816,
    98819,
    98820,
    98821,
    98822,
    98827,
    98828,
    98830,
    98836,
    98885,
    98891,
    98914,
    98916,
    98918,
    98920,
    98922,
    98923,
    98929,
    98933,
    98949
  );
  script_xref(name:"MSKB", value:"3118304");
  script_xref(name:"MSFT", value:"MS17-3118304");
  script_xref(name:"MSKB", value:"3118389");
  script_xref(name:"MSFT", value:"MS17-3118389");
  script_xref(name:"MSKB", value:"3127888");
  script_xref(name:"MSFT", value:"MS17-3127888");
  script_xref(name:"MSKB", value:"3162051");
  script_xref(name:"MSFT", value:"MS17-3162051");
  script_xref(name:"MSKB", value:"3178667");
  script_xref(name:"MSFT", value:"MS17-3178667");
  script_xref(name:"MSKB", value:"3191828");
  script_xref(name:"MSFT", value:"MS17-3191828");
  script_xref(name:"MSKB", value:"3191837");
  script_xref(name:"MSFT", value:"MS17-3191837");
  script_xref(name:"MSKB", value:"3191844");
  script_xref(name:"MSFT", value:"MS17-3191844");
  script_xref(name:"MSKB", value:"3191848");
  script_xref(name:"MSFT", value:"MS17-3191848");
  script_xref(name:"MSKB", value:"3191882");
  script_xref(name:"MSFT", value:"MS17-3191882");
  script_xref(name:"MSKB", value:"3191898");
  script_xref(name:"MSFT", value:"MS17-3191898");
  script_xref(name:"MSKB", value:"3191908");
  script_xref(name:"MSFT", value:"MS17-3191908");
  script_xref(name:"MSKB", value:"3191932");
  script_xref(name:"MSFT", value:"MS17-3191932");
  script_xref(name:"MSKB", value:"3191938");
  script_xref(name:"MSFT", value:"MS17-3191938");
  script_xref(name:"MSKB", value:"3191943");
  script_xref(name:"MSFT", value:"MS17-3191943");
  script_xref(name:"MSKB", value:"3191944");
  script_xref(name:"MSFT", value:"MS17-3191944");
  script_xref(name:"MSKB", value:"3191945");
  script_xref(name:"MSFT", value:"MS17-3191945");
  script_xref(name:"MSKB", value:"3203383");
  script_xref(name:"MSFT", value:"MS17-3203383");
  script_xref(name:"MSKB", value:"3203386");
  script_xref(name:"MSFT", value:"MS17-3203386");
  script_xref(name:"MSKB", value:"3203392");
  script_xref(name:"MSFT", value:"MS17-3203392");
  script_xref(name:"MSKB", value:"3203393");
  script_xref(name:"MSFT", value:"MS17-3203393");
  script_xref(name:"MSKB", value:"3203427");
  script_xref(name:"MSFT", value:"MS17-3203427");
  script_xref(name:"MSKB", value:"3203436");
  script_xref(name:"MSFT", value:"MS17-3203436");
  script_xref(name:"MSKB", value:"3203438");
  script_xref(name:"MSFT", value:"MS17-3203438");
  script_xref(name:"MSKB", value:"3203441");
  script_xref(name:"MSFT", value:"MS17-3203441");
  script_xref(name:"MSKB", value:"3203460");
  script_xref(name:"MSFT", value:"MS17-3203460");
  script_xref(name:"MSKB", value:"3203461");
  script_xref(name:"MSFT", value:"MS17-3203461");
  script_xref(name:"MSKB", value:"3203463");
  script_xref(name:"MSFT", value:"MS17-3203463");
  script_xref(name:"MSKB", value:"3203464");
  script_xref(name:"MSFT", value:"MS17-3203464");
  script_xref(name:"MSKB", value:"3203467");
  script_xref(name:"MSFT", value:"MS17-3203467");
  script_xref(name:"MSKB", value:"3203484");
  script_xref(name:"MSFT", value:"MS17-3203484");
  script_xref(name:"IAVA", value:"2017-A-0179");

  script_name(english:"Security Update for Microsoft Office Products (June 2017)");
  script_summary(english:"Checks the file versions.");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The Microsoft Office application installed on the remote Windows host
is missing a security update. It is, therefore, affected by multiple
vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in
    Microsoft Office due to improper validation of input
    before loading dynamic link library (DLL) files. An
    unauthenticated, remote attacker can exploit these, by
    convincing a user to open a specially crafted Office
    document, to execute arbitrary code in the context of
    the current user. (CVE-2017-0260. CVE-2017-8506)

  - Multiple information disclosure vulnerabilities exist in
    Windows Uniscribe due to improper handling of objects in
    memory. An unauthenticated, remote attacker can exploit
    these, by convincing a user to visit a specially crafted
    website or to open a specially crafted document file, to
    disclose the contents of memory. (CVE-2017-0282,
    CVE-2017-0284, CVE-2017-0285, CVE-2017-8534)

  - Multiple remote code execution vulnerabilities exist in
    Windows Uniscribe due to improper handling of objects in
    memory. An unauthenticated, remote attacker can exploit
    these, by convincing a user to visit a specially crafted
    website or open a specially crafted document, to execute
    arbitrary code in the context of the current user.
    (CVE-2017-0283, CVE-2017-8528)

  - Multiple information disclosure vulnerabilities exist in
    the Windows GDI component due to improper handling of
    objects in memory. An unauthenticated, remote attacker
    can exploit these, by convincing a user to visit a
    specially crafted website or to open a specially crafted
    document file, to disclose the contents of memory.
    (CVE-2017-0286, CVE-2017-0287, CVE-2017-0288,
    CVE-2017-0289, CVE-2017-8531, CVE-2017-8532,
    CVE-2017-8533)

  - A remote code execution vulnerability exists in
    Microsoft Windows due to improper parsing of PDF files.
    An unauthenticated, remote attacker can exploit this, by
    convincing a user to open a specially crafted PDF file,
    to execute arbitrary code in the context of the current
    user. (CVE-2017-0292)

  - A remote code execution vulnerability exists in
    Microsoft Outlook due to improper parsing of email
    messages. An unauthenticated, remote attacker can
    exploit this, by convincing a user to open a specially
    crafted email message, to execute arbitrary code in the
    context of the current user. (CVE-2017-8507)

  - A security bypass vulnerability exists in Microsoft
    Outlook due to improper parsing of file formats. An
    unauthenticated, remote attacker can exploit this, by
    convincing a user to open a specially crafted Office
    document, to bypass security feature protections.
    (CVE-2017-8508)

  - Multiple remote code execution vulnerabilities exist in
    Microsoft Office due to improper handling of objects in
    memory. An unauthenticated, remote attacker can exploit
    these, by convincing a user to open a specially crafted
    Office document, to execute arbitrary code in the
    context of the current user. (CVE-2017-8509,
    CVE-2017-8510, CVE-2017-8511, CVE-2017-8512,
    CVE-2017-8550)

  - A remote code execution vulnerability exists in
    Microsoft PowerPoint due to improper handling of objects
    in memory. An unauthenticated, remote attacker can
    exploit this, by convincing a user to open a specially
    crafted file, to execute arbitrary code in the context
    of the current user. (CVE-2017-8513)

  - A remote code execution vulnerability exists in the
    Windows font library due to improper handling of
    embedded fonts. An unauthenticated, remote attacker can
    exploit this, by convincing a user to visit a specially
    crafted website or open a specially crafted Microsoft
    document, to execute arbitrary code in the context of
    the current user. (CVE-2017-8527)");
  script_set_attribute(attribute:"see_also", value:"https://portal.msrc.microsoft.com/en-us/security-guidance/summary");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Microsoft Office 2007,
2010, 2013, and 2016; Microsoft OneNote 2010; Microsoft Outlook 2007,
2010, and 2016; Microsoft PowerPoint 2007; Microsoft Word 2007, 2010,
2013, and 2016; Microsoft Word Viewer; and Microsoft Office
Compatibility Pack.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/06/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:word");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:word_viewer");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office_compatibility_pack");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:onenote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:outlook");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:powerpoint");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("office_installed.nasl", "onenote_installed.nbin", "microsoft_office_compatibility_pack_installed.nbin", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_reg_query.inc");
include("misc_func.inc");
include("install_func.inc");

global_var vuln;

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = "MS17-06";
kbs = make_list(
  '3118304', # Office 2007 SP3
  '3118389', # Office 2010 SP2
  '3127888', # PowerPoint 2007 SP3
  '3162051', # Office 2013 SP1
  '3178667', # Office 2016
  '3191828', # Office 2007 SP3
  '3191837', # Office 2007 SP3
  '3191844', # Office 2010 SP2
  '3191848', # Office 2010 SP2
  '3191882', # Office 2016
  '3191898', # Outlook 2007 SP3
  '3191908', # OneNote 2010 SP2
  '3191932', # Outlook 2016
  '3191938', # Outlook 2013 SP1
  '3191943', # Office 2016
  '3191944', # Office 2016
  '3191945', # Word 2016
  '3203383', # Office 2016
  '3203386', # Office 2013 SP1
  '3203392', # Office 2013 SP1
  '3203393', # Word 2013 SP1
  '3203427', # Office Word Viewer
  '3203436', # Office 2007 SP3
  '3203438', # Office Compatibility Pack SP3
  '3203441', # Word 2007 SP3
  '3203460', # Office 2010 SP2
  '3203461', # Office 2010 SP2
  '3203463', # Office 2010 SP2
  '3203464', # Word 2010 SP2
  '3203467', # Outlook 2010 SP2
  '3203484'  # Office Word Viewer
);

if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/Registry/Enumerated", exit_code:1);

vuln = FALSE;
port = kb_smb_transport();

######################################################################
# Office 2007, 2010, 2013, 2016
######################################################################
function perform_office_checks()
{
  local_var office_vers, office_sp, common_path, path, prod, file, kb;
  office_vers = hotfix_check_office_version();

  ####################################################################
  # Office 2007 SP3 Checks
  ####################################################################
  if (office_vers["12.0"])
  {
    office_sp = get_kb_item("SMB/Office/2007/SP");
    if (!isnull(office_sp) && office_sp == 3)
    {
      prod = "Microsoft Office 2007 SP3";
      common_path = hotfix_get_officecommonfilesdir(officever:"12.0");

      path = hotfix_append_path(
               path  : common_path,
               value : "\Microsoft Shared\GRPHFLT"
      );
      if (hotfix_check_fversion(file:"pictim32.flt", version:"2006.1200.6769.5000", min_version:"2006.1200.0.0", path:path, kb:"3118304", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;

      path = hotfix_append_path(
        path  : common_path,
        value : "Microsoft Shared\Office12"
      );
      if (hotfix_check_fversion(file:"ogl.dll", version:"12.0.6769.5000", path:path, kb:"3191828", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;
      if (hotfix_check_fversion(file:"mso.dll", version:"12.0.6770.5000", path:path, kb:"3203436", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;

      path = hotfix_get_officeprogramfilesdir(officever:"12.0");
      if (hotfix_check_fversion(file:"usp10.dll", version:"1.626.6002.24099", path:path, kb:"3191837", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;
    }
  }

  ####################################################################
  # Office 2010 SP2 Checks
  # wwlibcxm.dll only exists if KB2428677 is installed
  ####################################################################
  if (office_vers["14.0"])
  {
    office_sp = get_kb_item("SMB/Office/2010/SP");
    if (!isnull(office_sp) && office_sp == 2)
    {
      prod = "Microsoft Office 2010 SP2";
      common_path = hotfix_get_officecommonfilesdir(officever:"14.0");

      path = hotfix_append_path(
        path  : common_path,
        value : "Microsoft Shared\Office14"
      );
      if (hotfix_check_fversion(file:"mso.dll", version:"14.0.7182.5000", path:path, kb:"3203460", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;
      if (hotfix_check_fversion(file:"ogl.dll", version:"14.0.7182.5000", path:path, kb:"3191848", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;

      path = hotfix_append_path(
        path  : common_path,
        value : "\Microsoft Shared\GRPHFLT"
      );
      if (hotfix_check_fversion(file:"epsimp32.flt", version:"2010.1400.7182.5000", min_version:"2010.1400.0.0", path:path, kb:"3203461", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;

      path = hotfix_get_officeprogramfilesdir(officever:"14.0");
      if (hotfix_check_fversion(file:"wwlibcxm.dll", version:"14.0.7182.5000", path:path, kb:"3203463", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;
      if (hotfix_check_fversion(file:"usp10.dll", version:"1.0626.7601.23800", path:path, kb:"3191844", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;
      if (hotfix_check_fversion(file:"offowc.dll", version:"14.0.7182.5000", path:path, kb:"3118389", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;
    }

    # The DCF folder is not always in the same bitness as Office, so
    # check both places
    path = hotfix_get_programfilesdir();
    path = hotfix_append_path(
      path  : path,
      value : "\Microsoft Office\Office15\DCF"
    );
    if (hotfix_check_fversion(file:"office.dll", version:"15.0.4937.1000", path:path, kb:"3162051", bulletin:bulletin, product:prod) == HCF_OLDER)
      vuln = TRUE;

    path = hotfix_get_programfilesdirx86();
    path = hotfix_append_path(
      path  : path,
      value : "\Microsoft Office\Office15\DCF"
    );
    if (hotfix_check_fversion(file:"office.dll", version:"15.0.4937.1000", path:path, kb:"3162051", bulletin:bulletin, product:prod) == HCF_OLDER)
      vuln = TRUE;
  }

  ####################################################################
  # Office 2013 SP1 Checks
  ####################################################################
  if (office_vers["15.0"])
  {
    office_sp = get_kb_item("SMB/Office/2013/SP");
    if (!isnull(office_sp) && office_sp == 1)
    {
      prod = "Microsoft Office 2013 SP1";
      common_path = hotfix_get_officecommonfilesdir(officever:"15.0");

      path = hotfix_append_path(
        path  : common_path,
        value : "Microsoft Shared\Office15"
      );
      if (hotfix_check_fversion(file:"mso.dll", version:"15.0.4937.1000", path:path, kb:"3203386", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;

      path = hotfix_append_path(
        path  : common_path,
        value : "Microsoft Shared\GRPHFLT"
      );
      if (hotfix_check_fversion(file:"epsimp32.flt", version:"2012.1500.4931.1000", min_version:"2012.1500.0.0", path:path, kb:"3203392", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;
    }
  }

  ####################################################################
  # Office 2016 Checks
  ####################################################################
  if (office_vers["16.0"])
  {
    office_sp = get_kb_item("SMB/Office/2016/SP");
    if (!isnull(office_sp) && office_sp == 0)
    {
      prod = "Microsoft Office 2016";
      common_path = hotfix_get_officecommonfilesdir(officever:"16.0");

      kb   = "3191944";
      file = "mso.dll";
      path = hotfix_append_path(
        path  : common_path,
        value : "Microsoft Shared\Office16"
      );
      if (
        hotfix_check_fversion(file:file, version:"16.0.4549.1001", channel:"MSI", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.7329.1059", channel:"Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.7726.1042", channel:"Deferred", channel_version:"1701", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"Current", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER
      )
        vuln = TRUE;

      kb   = "3178667";
      file = "mso20win32client.dll";
      # path is still <common files>\microsoft shared\office16
      if (
        hotfix_check_fversion(file:file, version:"16.0.4549.1000", channel:"MSI", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.7329.1059", channel:"Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.7726.1042", channel:"Deferred", channel_version:"1701", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"Current", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER
      )
        vuln = TRUE;

      kb   = "3191882";
      file = "mso30win32client.dll";
      # path is still <common files>\microsoft shared\office16
      if (
        hotfix_check_fversion(file:file, version:"16.0.4549.1000", channel:"MSI", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.7329.1059", channel:"Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.7726.1042", channel:"Deferred", channel_version:"1701", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER #||
        #hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        #hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"Current", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER
      )
        vuln = TRUE;

      kb   = "3191943";
      file = "mso299lwin32client.dll";
      # path is still <common files>\microsoft shared\office16
      if (
        hotfix_check_fversion(file:file, version:"16.0.4549.1000", channel:"MSI", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.7329.1059", channel:"Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.7726.1042", channel:"Deferred", channel_version:"1701", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"Current", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER
      )
        vuln = TRUE;

      kb   = "3203383";
      file = "epsimp32.flt";
      path = hotfix_append_path(
        path  : common_path,
        value : "Microsoft Shared\GRPHFLT"
      );
      if (
        hotfix_check_fversion(file:file, version:"2012.1600.4540.1000", min_version:"2012.1600.0.0", channel:"MSI", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"2012.1600.7329.1059", min_version:"2012.1600.0.0", channel:"Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"2012.1600.7726.1042", min_version:"2012.1600.0.0", channel:"Deferred", channel_version:"1701", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"2012.1600.8201.1003", min_version:"2012.1600.0.0", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"2012.1600.8201.1003", min_version:"2012.1600.0.0", channel:"Current", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER
      )
        vuln = TRUE;
    }
  }
}

######################################################################
# Word 2007, 2010, 2013, 2016
######################################################################
function perform_word_checks()
{
  local_var word_checks, kb16;

  kb16 = "3191945";
  word_checks = make_array(
    "12.0", make_array("sp", 3, "version", "12.0.6770.5000", "kb", "3203441"),
    "14.0", make_array("sp", 2, "version", "14.0.7182.5000", "kb", "3203464"),
    "15.0", make_array("sp", 1, "version", "15.0.4937.1000", "kb", "3203393"),
    "16.0", make_nested_list(
      make_array("sp", 0, "version", "16.0.4549.1000", "channel", "MSI", "kb", kb16),
      make_array("sp", 0, "version", "16.0.7369.2139", "channel", "Deferred", "kb", kb16),
      make_array("sp", 0, "version", "16.0.7766.2092", "channel", "Deferred", "channel_version", "1701", "kb", kb16),
      make_array("sp", 0, "version", "16.0.8201.2102", "channel", "First Release for Deferred", "kb", kb16),
      make_array("sp", 0, "version", "16.0.8201.2102", "channel", "Current", "kb", kb16)
    )
  );
  if (hotfix_check_office_product(product:"Word", checks:word_checks, bulletin:bulletin))
    vuln = TRUE;
}

######################################################################
# Compatibility Pack
######################################################################
function perform_comppack_checks()
{
  local_var install, installs, path;

  ####################################################################
  # Word Compatibility Pack
  ####################################################################
  installs = get_kb_list("SMB/Office/WordCnv/*/ProductPath");
  foreach install (keys(installs))
  {
    path = installs[install];
    path = ereg_replace(pattern:'^(.+)\\\\[^\\\\]+\\.exe$', replace:"\1\", string:path, icase:TRUE);
    if(hotfix_check_fversion(path:path, file:"wordcnv.dll",  version:"12.0.6770.5000", kb:"3203438", bulletin:bulletin, min_version:"12.0.0.0", product:"Microsoft Office Compatibility Pack") == HCF_OLDER)
      vuln = TRUE;
  }
}

######################################################################
# Word Viewer
######################################################################
function perform_viewer_checks()
{
  var install, installs, path;
  installs = get_kb_list("SMB/Office/WordViewer/*/ProductPath");
  foreach install (keys(installs))
  {
    path = installs[install];
    path = ereg_replace(pattern:'^(.+)\\\\[^\\\\]+\\.exe$', replace:"\1\", string:path, icase:TRUE);
    if(hotfix_check_fversion(path:path, file:"gdiplus.dll", version:"11.0.8442.0", kb:"3203484", bulletin:bulletin, product:"Microsoft Word Viewer") == HCF_OLDER)
      vuln = TRUE;
  }

  path = hotfix_get_officecommonfilesdir(officever:"11.0");
  path = hotfix_append_path(path:path, value:"Microsoft Shared\Office11");
  if(hotfix_check_fversion(path:path, file:"usp10.dll", version:"1.626.6002.24099", kb:"3203427", bulletin:bulletin, product:"Microsoft Word Viewer") == HCF_OLDER)
    vuln = TRUE;
}

######################################################################
# OneNote 2010
######################################################################
function perform_onenote_checks()
{
  var install, installs, prod, path;

  installs = get_installs(app_name:'Microsoft OneNote');
  foreach install (installs[1])
  {
    if (install["product"] == "2010" && install["sp"] == 2)
    {
      prod = "Microsoft OneNote 2010 SP2";
      path = tolower(install["path"]);
      path -= "onenote.exe";
      if (hotfix_check_fversion(file:"onenotesyncpc.dll", version:"14.0.7182.5000", path:path, kb:"3191908", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;
    }
  }
}

######################################################################
# Outlook 2007, 2010, 2013, 2016
######################################################################
function perform_outlook_checks()
{
  local_var checks, kb16;

  kb16 = "3191932";
  checks = make_array(
    "12.0", make_array("sp", 3, "version", "12.0.6770.5000", "kb", "3191898"),
    "14.0", make_array("sp", 2, "version", "14.0.7182.5000", "kb", "3203467"),
    "15.0", make_array("sp", 1, "version", "15.0.4937.1000", "kb", "3191938"),
    "16.0", make_nested_list(
      make_array("sp", 0, "version", "16.0.4549.1002", "channel", "MSI", "kb", kb16),
      make_array("sp", 0, "version", "16.0.7369.2139", "channel", "Deferred", "kb", kb16),
      make_array("sp", 0, "version", "16.0.7766.2092", "channel", "Deferred", "channel_version", "1701", "kb", kb16),
      make_array("sp", 0, "version", "16.0.8201.2102", "channel", "First Release for Deferred", "kb", kb16),
      make_array("sp", 0, "version", "16.0.8201.2102", "channel", "Current", "kb", kb16)
    )
  );
  if (hotfix_check_office_product(product:"Outlook", checks:checks, bulletin:bulletin))
    vuln = TRUE;
}

######################################################################
# PowerPoint 2007
######################################################################
function perform_powerpoint_checks()
{
  var install, installs, path;
  installs = get_kb_list("SMB/Office/PowerPoint/*/ProductPath");
  foreach install (keys(installs))
  {
    path = installs[install];
    path = ereg_replace(pattern:'^(.+)\\\\[^\\\\]+\\.exe$', replace:"\1\", string:path, icase:TRUE);
    if(hotfix_check_fversion(path:path, file:"ppcore.dll",  version:"12.0.6770.5000", kb:"3127888", bulletin:bulletin, min_version:"12.0.0.0", product:"Microsoft PowerPoint") == HCF_OLDER)
      vuln = TRUE;
  }
}

######################################################################
# MAIN
######################################################################
perform_office_checks();
perform_word_checks();
perform_comppack_checks();
perform_viewer_checks();
perform_onenote_checks();
perform_outlook_checks();
perform_powerpoint_checks();

if (vuln)
{
  replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_JUN_WIN2008.NASL
    descriptionThe remote Windows host is missing multiple security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user
    last seen2020-06-01
    modified2020-06-02
    plugin id100786
    published2017-06-14
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100786
    titleWindows 2008 June 2017 Multiple Security Updates
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the Microsoft Security Updates API. The text
# itself is copyright (C) Microsoft Corporation.
#

include("compat.inc");

if (description)
{
  script_id(100786);
  script_version("1.19");
  script_cvs_date("Date: 2018/11/15 20:50:32");

  script_cve_id(
    "CVE-2016-3326",
    "CVE-2017-0167",
    "CVE-2017-0193",
    "CVE-2017-0260",
    "CVE-2017-0282",
    "CVE-2017-0283",
    "CVE-2017-0284",
    "CVE-2017-0285",
    "CVE-2017-0287",
    "CVE-2017-0288",
    "CVE-2017-0289",
    "CVE-2017-0294",
    "CVE-2017-0296",
    "CVE-2017-0299",
    "CVE-2017-0300",
    "CVE-2017-8462",
    "CVE-2017-8464",
    "CVE-2017-8469",
    "CVE-2017-8470",
    "CVE-2017-8471",
    "CVE-2017-8472",
    "CVE-2017-8473",
    "CVE-2017-8475",
    "CVE-2017-8476",
    "CVE-2017-8477",
    "CVE-2017-8478",
    "CVE-2017-8479",
    "CVE-2017-8480",
    "CVE-2017-8481",
    "CVE-2017-8482",
    "CVE-2017-8483",
    "CVE-2017-8484",
    "CVE-2017-8485",
    "CVE-2017-8488",
    "CVE-2017-8489",
    "CVE-2017-8491",
    "CVE-2017-8492",
    "CVE-2017-8517",
    "CVE-2017-8519",
    "CVE-2017-8527",
    "CVE-2017-8528",
    "CVE-2017-8531",
    "CVE-2017-8532",
    "CVE-2017-8533",
    "CVE-2017-8534",
    "CVE-2017-8543",
    "CVE-2017-8544",
    "CVE-2017-8553",
    "CVE-2017-8554"
  );
  script_bugtraq_id(
    97473,
    98810,
    98818,
    98819,
    98820,
    98821,
    98822,
    98824,
    98826,
    98837,
    98839,
    98842,
    98845,
    98847,
    98848,
    98849,
    98851,
    98852,
    98853,
    98854,
    98856,
    98857,
    98858,
    98859,
    98860,
    98862,
    98864,
    98865,
    98869,
    98870,
    98878,
    98884,
    98885,
    98900,
    98901,
    98903,
    98914,
    98918,
    98920,
    98922,
    98923,
    98929,
    98933,
    98940,
    98942,
    98949
  );
  script_xref(name:"MSKB", value:"3217845");
  script_xref(name:"MSFT", value:"MS17-3217845");
  script_xref(name:"MSKB", value:"4018106");
  script_xref(name:"MSFT", value:"MS17-4018106");
  script_xref(name:"MSKB", value:"4021903");
  script_xref(name:"MSFT", value:"MS17-4021903");
  script_xref(name:"MSKB", value:"4021558");
  script_xref(name:"MSFT", value:"MS17-4021558");
  script_xref(name:"MSKB", value:"4021923");
  script_xref(name:"MSFT", value:"MS17-4021923");
  script_xref(name:"MSKB", value:"4022008");
  script_xref(name:"MSFT", value:"MS17-4022008");
  script_xref(name:"MSKB", value:"4022010");
  script_xref(name:"MSFT", value:"MS17-4022010");
  script_xref(name:"MSKB", value:"4022013");
  script_xref(name:"MSFT", value:"MS17-4022013");
  script_xref(name:"MSKB", value:"4022883");
  script_xref(name:"MSFT", value:"MS17-4022883");
  script_xref(name:"MSKB", value:"4022884");
  script_xref(name:"MSFT", value:"MS17-4022884");
  script_xref(name:"MSKB", value:"4022887");
  script_xref(name:"MSFT", value:"MS17-4022887");
  script_xref(name:"MSKB", value:"4024402");
  script_xref(name:"MSFT", value:"MS17-4024402");

  script_name(english:"Windows 2008 June 2017 Multiple Security Updates");
  script_summary(english:"Checks the existence of Windows Server 2008 June 2017 Patches.");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Windows host is missing multiple security updates. It is,
therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when 
    affected Microsoft browsers improperly handle objects 
    in memory. An attacker who successfully exploited the 
    vulnerability could obtain information to further 
    compromise the user's system. (CVE-2016-3326)

  - An information disclosure vulnerability exists when 
    the Windows kernel improperly handles objects in memory. 
    An attacker who successfully exploited this vulnerability 
    could obtain information to further compromise the user's 
    system.(CVE-2017-0167)

  - An elevation of privilege vulnerability exists in
    Windows Hyper-V instruction emulation due to a failure
    to properly enforce privilege levels. An attacker on a
    guest operating system can exploit this to gain elevated
    privileges on the guest. Note that the host operating
    system is not vulnerable. (CVE-2017-0193)

  - A remote code execution vulnerability exists in
    Microsoft Office due to improper validation of
    user-supplied input before loading dynamic link library
    (DLL) files. An unauthenticated, remote attacker can
    exploit this, by convincing a user to open a specially
    crafted file, to execute arbitrary code in the context
    of the current user. (CVE-2017-0260)

  - Multiple information disclosure vulnerabilities exist in
    Windows Uniscribe due to improper handling of objects in
    memory. An unauthenticated, remote attacker can exploit
    these, by convincing a user to visit a specially crafted
    website or to open a specially crafted document file, to
    disclose the contents of memory. (CVE-2017-0282,
    CVE-2017-0284, CVE-2017-0285, CVE-2017-8534)

  - Multiple remote code execution vulnerabilities exist in
    Windows Uniscribe software due to improper handling of
    objects in memory. An unauthenticated, remote attacker
    can exploit these, by convincing a user to visit a
    specially crafted website or to open a specially crafted
    document file, to execute arbitrary code in the context
    of the current user. (CVE-2017-0283, CVE-2017-8528)

  - Multiple information disclosure vulnerabilities exist in
    the Windows GDI component due to improper handling of
    objects in memory. An unauthenticated, remote attacker
    can exploit these, by convincing a user to visit a
    specially crafted website or to open a specially crafted
    document file, to disclose the contents of memory.
    (CVE-2017-0287, CVE-2017-0288, CVE-2017-0289)

  - A remote code execution vulnerability exists in
    Microsoft Windows due to improper handling of cabinet
    files. An unauthenticated, remote attacker can exploit
    this, by convincing a user to open a specially crafted 
    cabinet file, to execute arbitrary code in the context
    of the current user. (CVE-2017-0294)

  - An elevation of privilege vulnerability exists in
    tdx.sys due to a failure to check the length of a buffer
    prior to copying memory to it. A local attacker can
    exploit this, via a specially crafted application, to
    execute arbitrary code in an elevated context.
    (CVE-2017-0296)

  - Multiple information disclosure vulnerabilities exist in
    the Windows kernel due to improper initialization of
    objects in memory. An authenticated, remote attacker can
    exploit these, via a specially crafted application, to
    disclose the base address of the kernel driver.
    (CVE-2017-0299, CVE-2017-0300, CVE-2017-8462,
    CVE-2017-8485)

  - A remote code execution vulnerability exists in Windows
    due to improper handling of shortcuts. An
    unauthenticated, remote attacker can exploit this, by
    convincing a user to insert a removable drive containing
    a malicious shortcut and binary, to automatically
    execute arbitrary code in the context of the current
    user. (CVE-2017-8464)

  - Multiple information disclosure vulnerabilities exist in
    the Windows kernel due to improper initialization of
    objects in memory. An authenticated, remote attacker can
    exploit these, via a specially crafted application, to
    disclose sensitive information. (CVE-2017-8469,
    CVE-2017-8470, CVE-2017-8471, CVE-2017-8472,
    CVE-2017-8473, CVE-2017-8475, CVE-2017-8476,
    CVE-2017-8477, CVE-2017-8478, CVE-2017-8479,
    CVE-2017-8480, CVE-2017-8481, CVE-2017-8482,
    CVE-2017-8483, CVE-2017-8484, CVE-2017-8488,
    CVE-2017-8489, CVE-2017-8491, CVE-2017-8492)

  - A remote code execution vulnerability exists in the way 
    JavaScript engines render when handling objects in memory 
    in Microsoft browsers. The vulnerability could corrupt 
    memory in such a way that an attacker could execute 
    arbitrary code in the context of the current user.
    (CVE-2017-8517)

  - A remote code execution vulnerability exists when Internet 
    Explorer improperly accesses objects in memory. This 
    vulnerability could corrupt memory in such a way that an 
    attacker could execute arbitrary code in the context of 
    the current user. (CVE-2017-8519)

  - A remote code execution vulnerability exists in the
    Windows font library due to improper handling of
    embedded fonts. An unauthenticated, remote attacker can
    exploit this, by convincing a user to visit a specially
    crafted website or open a specially crafted Microsoft
    document, to execute arbitrary code in the context of
    the current user. (CVE-2017-8527)

  - Multiple information disclosure vulnerabilities exist in
    the Windows GDI component due to improper handling of
    objects in memory. An unauthenticated, remote attacker
    can exploit these, by convincing a user to visit a
    specially crafted website or open a specially crafted
    document, to disclose the contents of memory.
    (CVE-2017-8531, CVE-2017-8532, CVE-2017-8533)

  - A remote code execution vulnerability exists in the
    Windows Search functionality due to improper handling of
    objects in memory. An unauthenticated, remote attacker
    can exploit this, via a specially crafted SMB message,
    to execute arbitrary code. (CVE-2017-8543)

  - An information disclosure vulnerability exists in the
    Windows Search functionality due to improper handling of
    objects in memory. An unauthenticated, remote attacker
    can exploit this, via a specially crafted SMB message,
    to disclose sensitive information. (CVE-2017-8544)

  - Multiple information disclosure vulnerabilities exist in
    the Windows kernel due to improper handling of objects
    in memory. An authenticated, remote attacker can exploit
    these, via a specially crafted application, to disclose
    the contents of memory. (CVE-2017-8553, CVE-2017-8554)");
  # https://support.microsoft.com/en-us/help/3217845/hypervisor-code-integrity-elevation-of-privilege-vulnerability
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?092d59db");
  # https://support.microsoft.com/en-us/help/4018106/microsoft-office-remote-code-execution-may-9-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?254e31fd");
  # https://support.microsoft.com/en-us/help/4021558/cumulative-security-update-for-internet-explorer-june-13-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f2d033c7");
  # https://support.microsoft.com/en-us/help/4021903/lnk-remote-code-execution-vulnerability-june-13-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fc374e23");
  # https://support.microsoft.com/en-us/help/4021923/windows-tdx-elevation-of-privilege-vulnerability-june-13-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?473a6578");
  # https://support.microsoft.com/en-us/help/4022008/windows-remote-code-execution-vulnerability-june-13-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1d418d6a");
  # https://support.microsoft.com/en-us/help/4022010/windows-kernel-information-disclosure-vulnerability-june-13-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?efcac01f");
  # https://support.microsoft.com/en-us/help/4022013/windows-kernel-information-disclosure-vulnerability-june-13-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b34d26a1");
  # https://support.microsoft.com/en-us/help/4022883/windows-kernel-information-disclosure-vulnerability-june-13-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ee2f1c8");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/en-us/help/4022884/security-update-for-windows-server-2008-june-13-2017");
  # https://support.microsoft.com/en-us/help/4022884/security-update-for-windows-server-2008-june-13-2017/security-update-for-windows-server-2008-june-13-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c4944e33");
  # https://support.microsoft.com/en-us/help/4024402/windows-search-vulnerabilities-in-windows-server-2008-june-13-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eb6eea1d");
  script_set_attribute(attribute:"solution", value:
"Apply the following security updates :

  - KB3217845
  - KB4018106
  - KB4021558
  - KB4021903
  - KB4021923
  - KB4022008
  - KB4022010
  - KB4022013
  - KB4022883
  - KB4022884
  - KB4022887
  - KB4024402");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'LNK Code Execution Vulnerability');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/06/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);

  script_copyright(english:"This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.");

  script_family(english:"Windows : Microsoft Bulletins");

  script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS17-06';

kbs = make_list(
  "3217845",
  "4018106",
  "4021558",
  "4021903",
  "4021923",
  "4022008",
  "4022010",
  "4022013",
  "4022883",
  "4022884",
  "4022887",
  "4024402"
);

if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

# KBs only apply to Windows 2008
if (hotfix_check_sp_range(vista:'2') <= 0)
  audit(AUDIT_OS_SP_NOT_VULN);

productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
if ("Vista" >< productname) audit(AUDIT_OS_SP_NOT_VULN);

systemroot = hotfix_get_systemroot();
if (!systemroot) audit(AUDIT_PATH_NOT_DETERMINED, 'system root');

port   = kb_smb_transport();
login  = kb_smb_login();
pass   = kb_smb_password();
domain = kb_smb_domain();

if (hotfix_check_fversion_init() == HCF_CONNECT) exit(0, "Unable to create SMB session.");

winsxs = ereg_replace(pattern:'^[A-Za-z]:(.*)', replace:"\1\WinSxS", string:systemroot);
winsxs_share = hotfix_path2share(path:systemroot);

rc = NetUseAdd(login:login, password:pass, domain:domain, share:winsxs_share);
if (rc != 1)
{
  NetUseDel();
  audit(AUDIT_SHARE_FAIL, winsxs_share);
}

the_session = make_array(
  'login',    login,
  'password', pass,
  'domain',   domain,
  'share',    winsxs_share
);

vuln = 0;

#
# 4024402
files = list_dir(basedir:winsxs, level:0, dir_pat:"windowssearchengine_31bf3856ad364e35_", file_pat:"^mssrch\.dll$", max_recurse:1);
vuln += hotfix_check_winsxs(os:'6.0',
                            sp:2,
                            files:files,
                            versions:make_list('7.0.6002.19805','7.0.6002.24123'),
                            max_versions:make_list('7.0.6002.20000','7.0.6002.99999'),
                            bulletin:bulletin,
                            kb:"4024402", session:the_session);

# 4021923
files = list_dir(basedir:winsxs, level:0, dir_pat:"tdi-over-tcpip_31bf3856ad364e35_", file_pat:"^tdx\.sys$", max_recurse:1);
vuln += hotfix_check_winsxs(os:'6.0',
                            sp:2,
                            files:files,
                            versions:make_list('6.0.6002.19787','6.0.6002.24105'),
                            max_versions:make_list('6.0.6002.20000','6.0.6002.99999'),
                            bulletin:bulletin,
                            kb:"4021923", session:the_session);
# 3217845
if(
  hotfix_is_vulnerable(os:"6.0", arch:"x64", sp:2, file:"hvax64.exe", version:"6.0.6002.19783", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"3217845") ||
  hotfix_is_vulnerable(os:"6.0", arch:"x64", sp:2, file:"hvax64.exe", version:"6.0.6002.24101", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"3217845")
  )
  vuln++;

# 4018106
if(
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"rundll32.exe", version:"6.0.6002.19770", min_version:"6.0.6000.16000", dir:"\system32", bulletin:bulletin, kb:"4018106") ||
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"rundll32.exe", version:"6.0.6002.24089", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4018106")
)
  vuln++;

# 4021903
if(
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"shell32.dll", version:"6.0.6002.19785", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"4021903") ||
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"shell32.dll", version:"6.0.6002.24102", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4021903")
  )
  vuln++;

# 4022008
if(
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"win32spl.dll", version:"6.0.6002.19783", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"4022008") ||
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"win32spl.dll", version:"6.0.6002.24101", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4022008")
  )
  vuln++;

# 4022010
if(
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"msmmsp.dll", version:"6.0.6002.19784", min_version:"6.0.6000.16000", dir:"\system32", bulletin:bulletin, kb:"4022010") ||
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"msmmsp.dll", version:"6.0.6002.24102", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4022010")
  )
  vuln++;

# 4022013
if(
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"ntoskrnl.exe", version:"6.0.6002.19790", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"4022013") ||
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"ntoskrnl.exe", version:"6.0.6002.24108", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4022013")
  )
  vuln++;

# 4022883
if(hotfix_is_vulnerable(os:"6.0", sp:2, file:"atmfd.dll", version:"5.1.2.252", dir:"\system32", bulletin:bulletin, kb:"4022883"))
  vuln++;

# 4022884
if(
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"gdi32.dll", version:"6.0.6002.19787", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"4022884") ||
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"gdi32.dll", version:"6.0.6002.24105", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4022884")
  )
  vuln++;

# 4022887
if(
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"win32k.sys", version:"6.0.6002.19787", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"4022887") ||
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"win32k.sys", version:"6.0.6002.24105", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4022887")
  )
  vuln++;

# 4021558
if(
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"mshtml.dll", version:"9.0.8112.21017", min_version:"9.0.8112.20000", dir:"\system32", bulletin:bulletin, kb:"4021558") ||
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"mshtml.dll", version:"9.0.8112.16906", min_version:"9.0.8112.16000", dir:"\system32", bulletin:bulletin, kb:"4021558")
)
  vuln++;

if (vuln > 0)
{
  replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_JUN_4022719.NASL
    descriptionThe remote Windows host is missing security update 4022722 or cumulative update 4022719. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows Hyper-V instruction emulation due to a failure to properly enforce privilege levels. An attacker on a guest operating system can exploit this to gain elevated privileges on the guest. Note that the host operating system is not vulnerable. (CVE-2017-0193) - A remote code execution vulnerability exists in Microsoft Office due to improper validation of user-supplied input before loading dynamic link library (DLL) files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute arbitrary code in the context of the current user. (CVE-2017-0260) - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0284, CVE-2017-0285, CVE-2017-8534) - Multiple remote code execution vulnerabilities exist in Windows Uniscribe software due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to execute arbitrary code in the context of the current user. (CVE-2017-0283, CVE-2017-8528) - Mutiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0286, CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533) - A remote code execution vulnerability exists in Microsoft Windows due to improper handling of cabinet files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted cabinet file, to execute arbitrary code in the context of the current user. (CVE-2017-0294) - An elevation of privilege vulnerability exists in tdx.sys due to a failure to check the length of a buffer prior to copying memory to it. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code in an elevated context. (CVE-2017-0296) - An elevation of privilege vulnerability exists in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code with elevated permissions. (CVE-2017-0297) - An elevation of privilege vulnerability exists in the DCOM object in Helppane.exe, when configured to run as the interactive user, due to a failure to properly authenticate the client. An authenticated, remote attacker can exploit this, via a specially crafted application, to run arbitrary code in another user
    last seen2020-05-31
    modified2017-06-13
    plugin id100761
    published2017-06-13
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100761
    titleWindows 7 and Windows Server 2008 R2 June 2017 Security Updates
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(100761);
  script_version("1.21");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/28");

  script_cve_id(
    "CVE-2017-0193",
    "CVE-2017-0260",
    "CVE-2017-0282",
    "CVE-2017-0283",
    "CVE-2017-0284",
    "CVE-2017-0285",
    "CVE-2017-0286",
    "CVE-2017-0287",
    "CVE-2017-0288",
    "CVE-2017-0289",
    "CVE-2017-0294",
    "CVE-2017-0296",
    "CVE-2017-0297",
    "CVE-2017-0298",
    "CVE-2017-0299",
    "CVE-2017-0300",
    "CVE-2017-8462",
    "CVE-2017-8464",
    "CVE-2017-8469",
    "CVE-2017-8470",
    "CVE-2017-8471",
    "CVE-2017-8472",
    "CVE-2017-8473",
    "CVE-2017-8475",
    "CVE-2017-8476",
    "CVE-2017-8477",
    "CVE-2017-8478",
    "CVE-2017-8479",
    "CVE-2017-8480",
    "CVE-2017-8481",
    "CVE-2017-8482",
    "CVE-2017-8483",
    "CVE-2017-8484",
    "CVE-2017-8485",
    "CVE-2017-8488",
    "CVE-2017-8489",
    "CVE-2017-8490",
    "CVE-2017-8491",
    "CVE-2017-8492",
    "CVE-2017-8519",
    "CVE-2017-8524",
    "CVE-2017-8527",
    "CVE-2017-8528",
    "CVE-2017-8531",
    "CVE-2017-8532",
    "CVE-2017-8533",
    "CVE-2017-8534",
    "CVE-2017-8543",
    "CVE-2017-8544",
    "CVE-2017-8547",
    "CVE-2017-8553",
    "CVE-2017-8554"
  );
  script_bugtraq_id(
    98810,
    98818,
    98819,
    98820,
    98821,
    98822,
    98824,
    98826,
    98837,
    98839,
    98840,
    98842,
    98845,
    98847,
    98848,
    98849,
    98851,
    98852,
    98853,
    98854,
    98856,
    98857,
    98858,
    98859,
    98860,
    98862,
    98864,
    98865,
    98867,
    98869,
    98870,
    98878,
    98884,
    98885,
    98891,
    98899,
    98900,
    98901,
    98903,
    98914,
    98918,
    98920,
    98922,
    98923,
    98929,
    98930,
    98932,
    98933,
    98940,
    98942,
    98949,
    98953
  );
  script_xref(name:"MSKB", value:"4022719");
  script_xref(name:"MSFT", value:"MS17-4022719");
  script_xref(name:"MSKB", value:"4022722");
  script_xref(name:"MSFT", value:"MS17-4022722");

  script_name(english:"Windows 7 and Windows Server 2008 R2 June 2017 Security Updates");
  script_summary(english:"Checks for rollup.");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote Windows host is missing security update 4022722
or cumulative update 4022719. It is, therefore, affected by
multiple vulnerabilities :

  - An elevation of privilege vulnerability exists in
    Windows Hyper-V instruction emulation due to a failure
    to properly enforce privilege levels. An attacker on a
    guest operating system can exploit this to gain elevated
    privileges on the guest. Note that the host operating
    system is not vulnerable. (CVE-2017-0193)

  - A remote code execution vulnerability exists in
    Microsoft Office due to improper validation of
    user-supplied input before loading dynamic link library
    (DLL) files. An unauthenticated, remote attacker can
    exploit this, by convincing a user to open a specially
    crafted file, to execute arbitrary code in the context
    of the current user. (CVE-2017-0260)

  - Multiple information disclosure vulnerabilities exist in
    Windows Uniscribe due to improper handling of objects in
    memory. An unauthenticated, remote attacker can exploit
    these, by convincing a user to visit a specially crafted
    website or to open a specially crafted document file, to
    disclose the contents of memory. (CVE-2017-0282,
    CVE-2017-0284, CVE-2017-0285, CVE-2017-8534)

  - Multiple remote code execution vulnerabilities exist in
    Windows Uniscribe software due to improper handling of
    objects in memory. An unauthenticated, remote attacker
    can exploit these, by convincing a user to visit a
    specially crafted website or to open a specially crafted
    document file, to execute arbitrary code in the context
    of the current user. (CVE-2017-0283, CVE-2017-8528)

  - Mutiple information disclosure vulnerabilities exist in
    the Windows GDI component due to improper handling of
    objects in memory. An unauthenticated, remote attacker
    can exploit these, by convincing a user to visit a
    specially crafted website or to open a specially crafted
    document file, to disclose the contents of memory.
    (CVE-2017-0286, CVE-2017-0287, CVE-2017-0288,
    CVE-2017-0289, CVE-2017-8531, CVE-2017-8532,
    CVE-2017-8533)

  - A remote code execution vulnerability exists in
    Microsoft Windows due to improper handling of cabinet
    files. An unauthenticated, remote attacker can exploit
    this, by convincing a user to open a specially crafted
    cabinet file, to execute arbitrary code in the context
    of the current user. (CVE-2017-0294)

  - An elevation of privilege vulnerability exists in
    tdx.sys due to a failure to check the length of a buffer
    prior to copying memory to it. A local attacker can
    exploit this, via a specially crafted application, to
    execute arbitrary code in an elevated context.
    (CVE-2017-0296)

  - An elevation of privilege vulnerability exists in the
    Windows kernel due to improper handling of objects in
    memory. A local attacker can exploit this, via a
    specially crafted application, to execute arbitrary code
    with elevated permissions. (CVE-2017-0297)

  - An elevation of privilege vulnerability exists in the
    DCOM object in Helppane.exe, when configured to run as
    the interactive user, due to a failure to properly
    authenticate the client. An authenticated, remote
    attacker can exploit this, via a specially crafted
    application, to run arbitrary code in another user's
    session after that user has logged on to the same system
    using Terminal Services or Fast User Switching.
    (CVE-2017-0298)

  - Multiple information disclosure vulnerabilities exist in
    the Windows kernel due to improper initialization of
    objects in memory. An authenticated, remote attacker can
    exploit these, via a specially crafted application, to
    disclose the base address of the kernel driver.
    (CVE-2017-0299, CVE-2017-0300, CVE-2017-8462)

  - A remote code execution vulnerability exists in Windows
    due to improper handling of shortcuts. An
    unauthenticated, remote attacker can exploit this, by
    convincing a user to insert a removable drive containing
    a malicious shortcut and binary, to automatically
    execute arbitrary code in the context of the current
    user. (CVE-2017-8464)

  - Multiple information disclosure vulnerabilities exist in
    the Windows kernel due to improper initialization of
    objects in memory. An authenticated, remote attacker can
    exploit these, via a specially crafted application, to
    disclose sensitive information. (CVE-2017-8469,
    CVE-2017-8470, CVE-2017-8471, CVE-2017-8472,
    CVE-2017-8473, CVE-2017-8475, CVE-2017-8476,
    CVE-2017-8477, CVE-2017-8478, CVE-2017-8479,
    CVE-2017-8480, CVE-2017-8481, CVE-2017-8482,
    CVE-2017-8483, CVE-2017-8484, CVE-2017-8485,
    CVE-2017-8488, CVE-2017-8489, CVE-2017-8490,
    CVE-2017-8491, CVE-2017-8492)

  - Multiple remote code execution vulnerabilities exist in
    Internet Explorer due to improper handling of objects in
    memory. An unauthenticated, remote attacker can exploit
    these, by convincing a user to visit a specially crafted
    website, to execute arbitrary code in the context of the
    current user. (CVE-2017-8519, CVE-2017-8547)

  - A remote code execution vulnerability exists in
    Microsoft browsers in the JavaScript engines due to
    improper handling of objects in memory. An
    unauthenticated, remote attacker can exploit this, by
    convincing a user to visit a specially crafted website,
    to execute arbitrary code in the context of the current
    user. (CVE-2017-8524)

  - A remote code execution vulnerability exists in the
    Windows font library due to improper handling of
    embedded fonts. An unauthenticated, remote attacker can
    exploit this, by convincing a user to visit a specially
    crafted website or open a specially crafted Microsoft
    document, to execute arbitrary code in the context of
    the current user. (CVE-2017-8527)

  - A remote code execution vulnerability exists in the
    Windows Search functionality due to improper handling of
    objects in memory. An unauthenticated, remote attacker
    can exploit this, via a specially crafted SMB message,
    to execute arbitrary code. (CVE-2017-8543)

  - An information disclosure vulnerability exists in the
    Windows Search functionality due to improper handling of
    objects in memory. An unauthenticated, remote attacker
    can exploit this, via a specially crafted SMB message,
    to disclose sensitive information. (CVE-2017-8544)

  - Multiple information disclosure vulnerabilities exist in
    the Windows kernel due to improper handling of objects
    in memory. An authenticated, remote attacker can exploit
    these, via a specially crafted application, to disclose
    the contents of memory. (CVE-2017-8553, CVE-2017-8554)");
  # https://support.microsoft.com/en-us/help/4022719/windows-7-update-kb4022719
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?43db6287");
  # https://support.microsoft.com/en-us/help/4022722/windows-7-update-kb4022722
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f131905d");
  script_set_attribute(attribute:"solution", value:
"Apply Security Only update KB4022722 or Cumulative Update KB4022719.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-8543");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'LNK Code Execution Vulnerability');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/06/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);

  script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_family(english:"Windows : Microsoft Bulletins");

  script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

## NB: Microsoft
bulletin = 'MS17-06';
kbs = make_list("4022719", "4022722");

if (get_kb_item('Host/patch_management_checks'))
  hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

# KB only applies to Window 7 / 2008 R2, SP1
if (hotfix_check_sp_range(win7:'1') <= 0)
  audit(AUDIT_OS_SP_NOT_VULN);

share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

if (
  # Windows 7 / 2008 R2
  smb_check_rollup(os:"6.1", sp:1, rollup_date:"06_2017", bulletin:bulletin, rollup_kb_list:[4022719, 4022722]))
{
  replace_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
}

References