Vulnerabilities > CVE-2017-8534 - Information Exposure vulnerability in Microsoft Office, Windows 7 and Windows Server 2008

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
microsoft
CWE-200
nessus

Summary

Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows improper disclosure of memory contents, aka "Windows Uniscribe Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0282, CVE-2017-0284, and CVE-2017-0285.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_JUN_OFFICE.NASL
    descriptionThe Microsoft Office application installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple remote code execution vulnerabilities exist in Microsoft Office due to improper validation of input before loading dynamic link library (DLL) files. An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted Office document, to execute arbitrary code in the context of the current user. (CVE-2017-0260. CVE-2017-8506) - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0284, CVE-2017-0285, CVE-2017-8534) - Multiple remote code execution vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to execute arbitrary code in the context of the current user. (CVE-2017-0283, CVE-2017-8528) - Multiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0286, CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533) - A remote code execution vulnerability exists in Microsoft Windows due to improper parsing of PDF files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted PDF file, to execute arbitrary code in the context of the current user. (CVE-2017-0292) - A remote code execution vulnerability exists in Microsoft Outlook due to improper parsing of email messages. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted email message, to execute arbitrary code in the context of the current user. (CVE-2017-8507) - A security bypass vulnerability exists in Microsoft Outlook due to improper parsing of file formats. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted Office document, to bypass security feature protections. (CVE-2017-8508) - Multiple remote code execution vulnerabilities exist in Microsoft Office due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted Office document, to execute arbitrary code in the context of the current user. (CVE-2017-8509, CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, CVE-2017-8550) - A remote code execution vulnerability exists in Microsoft PowerPoint due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute arbitrary code in the context of the current user. (CVE-2017-8513) - A remote code execution vulnerability exists in the Windows font library due to improper handling of embedded fonts. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website or open a specially crafted Microsoft document, to execute arbitrary code in the context of the current user. (CVE-2017-8527)
    last seen2020-06-01
    modified2020-06-02
    plugin id100782
    published2017-06-14
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100782
    titleSecurity Update for Microsoft Office Products (June 2017)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100782);
      script_version("1.13");
      script_cvs_date("Date: 2019/11/22");
    
      script_cve_id(
        "CVE-2017-0260",
        "CVE-2017-0282",
        "CVE-2017-0283",
        "CVE-2017-0284",
        "CVE-2017-0285",
        "CVE-2017-0286",
        "CVE-2017-0287",
        "CVE-2017-0288",
        "CVE-2017-0289",
        "CVE-2017-0292",
        "CVE-2017-8506",
        "CVE-2017-8507",
        "CVE-2017-8508",
        "CVE-2017-8509",
        "CVE-2017-8510",
        "CVE-2017-8511",
        "CVE-2017-8512",
        "CVE-2017-8513",
        "CVE-2017-8527",
        "CVE-2017-8528",
        "CVE-2017-8531",
        "CVE-2017-8532",
        "CVE-2017-8533",
        "CVE-2017-8534",
        "CVE-2017-8550"
      );
      script_bugtraq_id(
        98810,
        98811,
        98812,
        98813,
        98815,
        98816,
        98819,
        98820,
        98821,
        98822,
        98827,
        98828,
        98830,
        98836,
        98885,
        98891,
        98914,
        98916,
        98918,
        98920,
        98922,
        98923,
        98929,
        98933,
        98949
      );
      script_xref(name:"MSKB", value:"3118304");
      script_xref(name:"MSFT", value:"MS17-3118304");
      script_xref(name:"MSKB", value:"3118389");
      script_xref(name:"MSFT", value:"MS17-3118389");
      script_xref(name:"MSKB", value:"3127888");
      script_xref(name:"MSFT", value:"MS17-3127888");
      script_xref(name:"MSKB", value:"3162051");
      script_xref(name:"MSFT", value:"MS17-3162051");
      script_xref(name:"MSKB", value:"3178667");
      script_xref(name:"MSFT", value:"MS17-3178667");
      script_xref(name:"MSKB", value:"3191828");
      script_xref(name:"MSFT", value:"MS17-3191828");
      script_xref(name:"MSKB", value:"3191837");
      script_xref(name:"MSFT", value:"MS17-3191837");
      script_xref(name:"MSKB", value:"3191844");
      script_xref(name:"MSFT", value:"MS17-3191844");
      script_xref(name:"MSKB", value:"3191848");
      script_xref(name:"MSFT", value:"MS17-3191848");
      script_xref(name:"MSKB", value:"3191882");
      script_xref(name:"MSFT", value:"MS17-3191882");
      script_xref(name:"MSKB", value:"3191898");
      script_xref(name:"MSFT", value:"MS17-3191898");
      script_xref(name:"MSKB", value:"3191908");
      script_xref(name:"MSFT", value:"MS17-3191908");
      script_xref(name:"MSKB", value:"3191932");
      script_xref(name:"MSFT", value:"MS17-3191932");
      script_xref(name:"MSKB", value:"3191938");
      script_xref(name:"MSFT", value:"MS17-3191938");
      script_xref(name:"MSKB", value:"3191943");
      script_xref(name:"MSFT", value:"MS17-3191943");
      script_xref(name:"MSKB", value:"3191944");
      script_xref(name:"MSFT", value:"MS17-3191944");
      script_xref(name:"MSKB", value:"3191945");
      script_xref(name:"MSFT", value:"MS17-3191945");
      script_xref(name:"MSKB", value:"3203383");
      script_xref(name:"MSFT", value:"MS17-3203383");
      script_xref(name:"MSKB", value:"3203386");
      script_xref(name:"MSFT", value:"MS17-3203386");
      script_xref(name:"MSKB", value:"3203392");
      script_xref(name:"MSFT", value:"MS17-3203392");
      script_xref(name:"MSKB", value:"3203393");
      script_xref(name:"MSFT", value:"MS17-3203393");
      script_xref(name:"MSKB", value:"3203427");
      script_xref(name:"MSFT", value:"MS17-3203427");
      script_xref(name:"MSKB", value:"3203436");
      script_xref(name:"MSFT", value:"MS17-3203436");
      script_xref(name:"MSKB", value:"3203438");
      script_xref(name:"MSFT", value:"MS17-3203438");
      script_xref(name:"MSKB", value:"3203441");
      script_xref(name:"MSFT", value:"MS17-3203441");
      script_xref(name:"MSKB", value:"3203460");
      script_xref(name:"MSFT", value:"MS17-3203460");
      script_xref(name:"MSKB", value:"3203461");
      script_xref(name:"MSFT", value:"MS17-3203461");
      script_xref(name:"MSKB", value:"3203463");
      script_xref(name:"MSFT", value:"MS17-3203463");
      script_xref(name:"MSKB", value:"3203464");
      script_xref(name:"MSFT", value:"MS17-3203464");
      script_xref(name:"MSKB", value:"3203467");
      script_xref(name:"MSFT", value:"MS17-3203467");
      script_xref(name:"MSKB", value:"3203484");
      script_xref(name:"MSFT", value:"MS17-3203484");
      script_xref(name:"IAVA", value:"2017-A-0179");
    
      script_name(english:"Security Update for Microsoft Office Products (June 2017)");
      script_summary(english:"Checks the file versions.");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application installed on the remote Windows host is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The Microsoft Office application installed on the remote Windows host
    is missing a security update. It is, therefore, affected by multiple
    vulnerabilities :
    
      - Multiple remote code execution vulnerabilities exist in
        Microsoft Office due to improper validation of input
        before loading dynamic link library (DLL) files. An
        unauthenticated, remote attacker can exploit these, by
        convincing a user to open a specially crafted Office
        document, to execute arbitrary code in the context of
        the current user. (CVE-2017-0260. CVE-2017-8506)
    
      - Multiple information disclosure vulnerabilities exist in
        Windows Uniscribe due to improper handling of objects in
        memory. An unauthenticated, remote attacker can exploit
        these, by convincing a user to visit a specially crafted
        website or to open a specially crafted document file, to
        disclose the contents of memory. (CVE-2017-0282,
        CVE-2017-0284, CVE-2017-0285, CVE-2017-8534)
    
      - Multiple remote code execution vulnerabilities exist in
        Windows Uniscribe due to improper handling of objects in
        memory. An unauthenticated, remote attacker can exploit
        these, by convincing a user to visit a specially crafted
        website or open a specially crafted document, to execute
        arbitrary code in the context of the current user.
        (CVE-2017-0283, CVE-2017-8528)
    
      - Multiple information disclosure vulnerabilities exist in
        the Windows GDI component due to improper handling of
        objects in memory. An unauthenticated, remote attacker
        can exploit these, by convincing a user to visit a
        specially crafted website or to open a specially crafted
        document file, to disclose the contents of memory.
        (CVE-2017-0286, CVE-2017-0287, CVE-2017-0288,
        CVE-2017-0289, CVE-2017-8531, CVE-2017-8532,
        CVE-2017-8533)
    
      - A remote code execution vulnerability exists in
        Microsoft Windows due to improper parsing of PDF files.
        An unauthenticated, remote attacker can exploit this, by
        convincing a user to open a specially crafted PDF file,
        to execute arbitrary code in the context of the current
        user. (CVE-2017-0292)
    
      - A remote code execution vulnerability exists in
        Microsoft Outlook due to improper parsing of email
        messages. An unauthenticated, remote attacker can
        exploit this, by convincing a user to open a specially
        crafted email message, to execute arbitrary code in the
        context of the current user. (CVE-2017-8507)
    
      - A security bypass vulnerability exists in Microsoft
        Outlook due to improper parsing of file formats. An
        unauthenticated, remote attacker can exploit this, by
        convincing a user to open a specially crafted Office
        document, to bypass security feature protections.
        (CVE-2017-8508)
    
      - Multiple remote code execution vulnerabilities exist in
        Microsoft Office due to improper handling of objects in
        memory. An unauthenticated, remote attacker can exploit
        these, by convincing a user to open a specially crafted
        Office document, to execute arbitrary code in the
        context of the current user. (CVE-2017-8509,
        CVE-2017-8510, CVE-2017-8511, CVE-2017-8512,
        CVE-2017-8550)
    
      - A remote code execution vulnerability exists in
        Microsoft PowerPoint due to improper handling of objects
        in memory. An unauthenticated, remote attacker can
        exploit this, by convincing a user to open a specially
        crafted file, to execute arbitrary code in the context
        of the current user. (CVE-2017-8513)
    
      - A remote code execution vulnerability exists in the
        Windows font library due to improper handling of
        embedded fonts. An unauthenticated, remote attacker can
        exploit this, by convincing a user to visit a specially
        crafted website or open a specially crafted Microsoft
        document, to execute arbitrary code in the context of
        the current user. (CVE-2017-8527)");
      script_set_attribute(attribute:"see_also", value:"https://portal.msrc.microsoft.com/en-us/security-guidance/summary");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released a set of patches for Microsoft Office 2007,
    2010, 2013, and 2016; Microsoft OneNote 2010; Microsoft Outlook 2007,
    2010, and 2016; Microsoft PowerPoint 2007; Microsoft Word 2007, 2010,
    2013, and 2016; Microsoft Word Viewer; and Microsoft Office
    Compatibility Pack.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/06/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:word");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:word_viewer");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office_compatibility_pack");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:onenote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:outlook");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:powerpoint");
      script_set_attribute(attribute:"stig_severity", value:"II");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("office_installed.nasl", "onenote_installed.nbin", "microsoft_office_compatibility_pack_installed.nbin", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_reg_query.inc");
    include("misc_func.inc");
    include("install_func.inc");
    
    global_var vuln;
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS17-06";
    kbs = make_list(
      '3118304', # Office 2007 SP3
      '3118389', # Office 2010 SP2
      '3127888', # PowerPoint 2007 SP3
      '3162051', # Office 2013 SP1
      '3178667', # Office 2016
      '3191828', # Office 2007 SP3
      '3191837', # Office 2007 SP3
      '3191844', # Office 2010 SP2
      '3191848', # Office 2010 SP2
      '3191882', # Office 2016
      '3191898', # Outlook 2007 SP3
      '3191908', # OneNote 2010 SP2
      '3191932', # Outlook 2016
      '3191938', # Outlook 2013 SP1
      '3191943', # Office 2016
      '3191944', # Office 2016
      '3191945', # Word 2016
      '3203383', # Office 2016
      '3203386', # Office 2013 SP1
      '3203392', # Office 2013 SP1
      '3203393', # Word 2013 SP1
      '3203427', # Office Word Viewer
      '3203436', # Office 2007 SP3
      '3203438', # Office Compatibility Pack SP3
      '3203441', # Word 2007 SP3
      '3203460', # Office 2010 SP2
      '3203461', # Office 2010 SP2
      '3203463', # Office 2010 SP2
      '3203464', # Word 2010 SP2
      '3203467', # Outlook 2010 SP2
      '3203484'  # Office Word Viewer
    );
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated", exit_code:1);
    
    vuln = FALSE;
    port = kb_smb_transport();
    
    ######################################################################
    # Office 2007, 2010, 2013, 2016
    ######################################################################
    function perform_office_checks()
    {
      local_var office_vers, office_sp, common_path, path, prod, file, kb;
      office_vers = hotfix_check_office_version();
    
      ####################################################################
      # Office 2007 SP3 Checks
      ####################################################################
      if (office_vers["12.0"])
      {
        office_sp = get_kb_item("SMB/Office/2007/SP");
        if (!isnull(office_sp) && office_sp == 3)
        {
          prod = "Microsoft Office 2007 SP3";
          common_path = hotfix_get_officecommonfilesdir(officever:"12.0");
    
          path = hotfix_append_path(
                   path  : common_path,
                   value : "\Microsoft Shared\GRPHFLT"
          );
          if (hotfix_check_fversion(file:"pictim32.flt", version:"2006.1200.6769.5000", min_version:"2006.1200.0.0", path:path, kb:"3118304", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
    
          path = hotfix_append_path(
            path  : common_path,
            value : "Microsoft Shared\Office12"
          );
          if (hotfix_check_fversion(file:"ogl.dll", version:"12.0.6769.5000", path:path, kb:"3191828", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
          if (hotfix_check_fversion(file:"mso.dll", version:"12.0.6770.5000", path:path, kb:"3203436", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
    
          path = hotfix_get_officeprogramfilesdir(officever:"12.0");
          if (hotfix_check_fversion(file:"usp10.dll", version:"1.626.6002.24099", path:path, kb:"3191837", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
        }
      }
    
      ####################################################################
      # Office 2010 SP2 Checks
      # wwlibcxm.dll only exists if KB2428677 is installed
      ####################################################################
      if (office_vers["14.0"])
      {
        office_sp = get_kb_item("SMB/Office/2010/SP");
        if (!isnull(office_sp) && office_sp == 2)
        {
          prod = "Microsoft Office 2010 SP2";
          common_path = hotfix_get_officecommonfilesdir(officever:"14.0");
    
          path = hotfix_append_path(
            path  : common_path,
            value : "Microsoft Shared\Office14"
          );
          if (hotfix_check_fversion(file:"mso.dll", version:"14.0.7182.5000", path:path, kb:"3203460", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
          if (hotfix_check_fversion(file:"ogl.dll", version:"14.0.7182.5000", path:path, kb:"3191848", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
    
          path = hotfix_append_path(
            path  : common_path,
            value : "\Microsoft Shared\GRPHFLT"
          );
          if (hotfix_check_fversion(file:"epsimp32.flt", version:"2010.1400.7182.5000", min_version:"2010.1400.0.0", path:path, kb:"3203461", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
    
          path = hotfix_get_officeprogramfilesdir(officever:"14.0");
          if (hotfix_check_fversion(file:"wwlibcxm.dll", version:"14.0.7182.5000", path:path, kb:"3203463", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
          if (hotfix_check_fversion(file:"usp10.dll", version:"1.0626.7601.23800", path:path, kb:"3191844", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
          if (hotfix_check_fversion(file:"offowc.dll", version:"14.0.7182.5000", path:path, kb:"3118389", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
        }
    
        # The DCF folder is not always in the same bitness as Office, so
        # check both places
        path = hotfix_get_programfilesdir();
        path = hotfix_append_path(
          path  : path,
          value : "\Microsoft Office\Office15\DCF"
        );
        if (hotfix_check_fversion(file:"office.dll", version:"15.0.4937.1000", path:path, kb:"3162051", bulletin:bulletin, product:prod) == HCF_OLDER)
          vuln = TRUE;
    
        path = hotfix_get_programfilesdirx86();
        path = hotfix_append_path(
          path  : path,
          value : "\Microsoft Office\Office15\DCF"
        );
        if (hotfix_check_fversion(file:"office.dll", version:"15.0.4937.1000", path:path, kb:"3162051", bulletin:bulletin, product:prod) == HCF_OLDER)
          vuln = TRUE;
      }
    
      ####################################################################
      # Office 2013 SP1 Checks
      ####################################################################
      if (office_vers["15.0"])
      {
        office_sp = get_kb_item("SMB/Office/2013/SP");
        if (!isnull(office_sp) && office_sp == 1)
        {
          prod = "Microsoft Office 2013 SP1";
          common_path = hotfix_get_officecommonfilesdir(officever:"15.0");
    
          path = hotfix_append_path(
            path  : common_path,
            value : "Microsoft Shared\Office15"
          );
          if (hotfix_check_fversion(file:"mso.dll", version:"15.0.4937.1000", path:path, kb:"3203386", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
    
          path = hotfix_append_path(
            path  : common_path,
            value : "Microsoft Shared\GRPHFLT"
          );
          if (hotfix_check_fversion(file:"epsimp32.flt", version:"2012.1500.4931.1000", min_version:"2012.1500.0.0", path:path, kb:"3203392", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
        }
      }
    
      ####################################################################
      # Office 2016 Checks
      ####################################################################
      if (office_vers["16.0"])
      {
        office_sp = get_kb_item("SMB/Office/2016/SP");
        if (!isnull(office_sp) && office_sp == 0)
        {
          prod = "Microsoft Office 2016";
          common_path = hotfix_get_officecommonfilesdir(officever:"16.0");
    
          kb   = "3191944";
          file = "mso.dll";
          path = hotfix_append_path(
            path  : common_path,
            value : "Microsoft Shared\Office16"
          );
          if (
            hotfix_check_fversion(file:file, version:"16.0.4549.1001", channel:"MSI", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.7329.1059", channel:"Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.7726.1042", channel:"Deferred", channel_version:"1701", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"Current", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER
          )
            vuln = TRUE;
    
          kb   = "3178667";
          file = "mso20win32client.dll";
          # path is still <common files>\microsoft shared\office16
          if (
            hotfix_check_fversion(file:file, version:"16.0.4549.1000", channel:"MSI", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.7329.1059", channel:"Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.7726.1042", channel:"Deferred", channel_version:"1701", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"Current", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER
          )
            vuln = TRUE;
    
          kb   = "3191882";
          file = "mso30win32client.dll";
          # path is still <common files>\microsoft shared\office16
          if (
            hotfix_check_fversion(file:file, version:"16.0.4549.1000", channel:"MSI", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.7329.1059", channel:"Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.7726.1042", channel:"Deferred", channel_version:"1701", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER #||
            #hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            #hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"Current", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER
          )
            vuln = TRUE;
    
          kb   = "3191943";
          file = "mso299lwin32client.dll";
          # path is still <common files>\microsoft shared\office16
          if (
            hotfix_check_fversion(file:file, version:"16.0.4549.1000", channel:"MSI", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.7329.1059", channel:"Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.7726.1042", channel:"Deferred", channel_version:"1701", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"16.0.8201.2102", channel:"Current", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER
          )
            vuln = TRUE;
    
          kb   = "3203383";
          file = "epsimp32.flt";
          path = hotfix_append_path(
            path  : common_path,
            value : "Microsoft Shared\GRPHFLT"
          );
          if (
            hotfix_check_fversion(file:file, version:"2012.1600.4540.1000", min_version:"2012.1600.0.0", channel:"MSI", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"2012.1600.7329.1059", min_version:"2012.1600.0.0", channel:"Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"2012.1600.7726.1042", min_version:"2012.1600.0.0", channel:"Deferred", channel_version:"1701", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"2012.1600.8201.1003", min_version:"2012.1600.0.0", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
            hotfix_check_fversion(file:file, version:"2012.1600.8201.1003", min_version:"2012.1600.0.0", channel:"Current", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER
          )
            vuln = TRUE;
        }
      }
    }
    
    ######################################################################
    # Word 2007, 2010, 2013, 2016
    ######################################################################
    function perform_word_checks()
    {
      local_var word_checks, kb16;
    
      kb16 = "3191945";
      word_checks = make_array(
        "12.0", make_array("sp", 3, "version", "12.0.6770.5000", "kb", "3203441"),
        "14.0", make_array("sp", 2, "version", "14.0.7182.5000", "kb", "3203464"),
        "15.0", make_array("sp", 1, "version", "15.0.4937.1000", "kb", "3203393"),
        "16.0", make_nested_list(
          make_array("sp", 0, "version", "16.0.4549.1000", "channel", "MSI", "kb", kb16),
          make_array("sp", 0, "version", "16.0.7369.2139", "channel", "Deferred", "kb", kb16),
          make_array("sp", 0, "version", "16.0.7766.2092", "channel", "Deferred", "channel_version", "1701", "kb", kb16),
          make_array("sp", 0, "version", "16.0.8201.2102", "channel", "First Release for Deferred", "kb", kb16),
          make_array("sp", 0, "version", "16.0.8201.2102", "channel", "Current", "kb", kb16)
        )
      );
      if (hotfix_check_office_product(product:"Word", checks:word_checks, bulletin:bulletin))
        vuln = TRUE;
    }
    
    ######################################################################
    # Compatibility Pack
    ######################################################################
    function perform_comppack_checks()
    {
      local_var install, installs, path;
    
      ####################################################################
      # Word Compatibility Pack
      ####################################################################
      installs = get_kb_list("SMB/Office/WordCnv/*/ProductPath");
      foreach install (keys(installs))
      {
        path = installs[install];
        path = ereg_replace(pattern:'^(.+)\\\\[^\\\\]+\\.exe$', replace:"\1\", string:path, icase:TRUE);
        if(hotfix_check_fversion(path:path, file:"wordcnv.dll",  version:"12.0.6770.5000", kb:"3203438", bulletin:bulletin, min_version:"12.0.0.0", product:"Microsoft Office Compatibility Pack") == HCF_OLDER)
          vuln = TRUE;
      }
    }
    
    ######################################################################
    # Word Viewer
    ######################################################################
    function perform_viewer_checks()
    {
      var install, installs, path;
      installs = get_kb_list("SMB/Office/WordViewer/*/ProductPath");
      foreach install (keys(installs))
      {
        path = installs[install];
        path = ereg_replace(pattern:'^(.+)\\\\[^\\\\]+\\.exe$', replace:"\1\", string:path, icase:TRUE);
        if(hotfix_check_fversion(path:path, file:"gdiplus.dll", version:"11.0.8442.0", kb:"3203484", bulletin:bulletin, product:"Microsoft Word Viewer") == HCF_OLDER)
          vuln = TRUE;
      }
    
      path = hotfix_get_officecommonfilesdir(officever:"11.0");
      path = hotfix_append_path(path:path, value:"Microsoft Shared\Office11");
      if(hotfix_check_fversion(path:path, file:"usp10.dll", version:"1.626.6002.24099", kb:"3203427", bulletin:bulletin, product:"Microsoft Word Viewer") == HCF_OLDER)
        vuln = TRUE;
    }
    
    ######################################################################
    # OneNote 2010
    ######################################################################
    function perform_onenote_checks()
    {
      var install, installs, prod, path;
    
      installs = get_installs(app_name:'Microsoft OneNote');
      foreach install (installs[1])
      {
        if (install["product"] == "2010" && install["sp"] == 2)
        {
          prod = "Microsoft OneNote 2010 SP2";
          path = tolower(install["path"]);
          path -= "onenote.exe";
          if (hotfix_check_fversion(file:"onenotesyncpc.dll", version:"14.0.7182.5000", path:path, kb:"3191908", bulletin:bulletin, product:prod) == HCF_OLDER)
            vuln = TRUE;
        }
      }
    }
    
    ######################################################################
    # Outlook 2007, 2010, 2013, 2016
    ######################################################################
    function perform_outlook_checks()
    {
      local_var checks, kb16;
    
      kb16 = "3191932";
      checks = make_array(
        "12.0", make_array("sp", 3, "version", "12.0.6770.5000", "kb", "3191898"),
        "14.0", make_array("sp", 2, "version", "14.0.7182.5000", "kb", "3203467"),
        "15.0", make_array("sp", 1, "version", "15.0.4937.1000", "kb", "3191938"),
        "16.0", make_nested_list(
          make_array("sp", 0, "version", "16.0.4549.1002", "channel", "MSI", "kb", kb16),
          make_array("sp", 0, "version", "16.0.7369.2139", "channel", "Deferred", "kb", kb16),
          make_array("sp", 0, "version", "16.0.7766.2092", "channel", "Deferred", "channel_version", "1701", "kb", kb16),
          make_array("sp", 0, "version", "16.0.8201.2102", "channel", "First Release for Deferred", "kb", kb16),
          make_array("sp", 0, "version", "16.0.8201.2102", "channel", "Current", "kb", kb16)
        )
      );
      if (hotfix_check_office_product(product:"Outlook", checks:checks, bulletin:bulletin))
        vuln = TRUE;
    }
    
    ######################################################################
    # PowerPoint 2007
    ######################################################################
    function perform_powerpoint_checks()
    {
      var install, installs, path;
      installs = get_kb_list("SMB/Office/PowerPoint/*/ProductPath");
      foreach install (keys(installs))
      {
        path = installs[install];
        path = ereg_replace(pattern:'^(.+)\\\\[^\\\\]+\\.exe$', replace:"\1\", string:path, icase:TRUE);
        if(hotfix_check_fversion(path:path, file:"ppcore.dll",  version:"12.0.6770.5000", kb:"3127888", bulletin:bulletin, min_version:"12.0.0.0", product:"Microsoft PowerPoint") == HCF_OLDER)
          vuln = TRUE;
      }
    }
    
    ######################################################################
    # MAIN
    ######################################################################
    perform_office_checks();
    perform_word_checks();
    perform_comppack_checks();
    perform_viewer_checks();
    perform_onenote_checks();
    perform_outlook_checks();
    perform_powerpoint_checks();
    
    if (vuln)
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, 'affected');
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_JUN_WIN2008.NASL
    descriptionThe remote Windows host is missing multiple security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user
    last seen2020-06-01
    modified2020-06-02
    plugin id100786
    published2017-06-14
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/100786
    titleWindows 2008 June 2017 Multiple Security Updates
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the Microsoft Security Updates API. The text
    # itself is copyright (C) Microsoft Corporation.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100786);
      script_version("1.19");
      script_cvs_date("Date: 2018/11/15 20:50:32");
    
      script_cve_id(
        "CVE-2016-3326",
        "CVE-2017-0167",
        "CVE-2017-0193",
        "CVE-2017-0260",
        "CVE-2017-0282",
        "CVE-2017-0283",
        "CVE-2017-0284",
        "CVE-2017-0285",
        "CVE-2017-0287",
        "CVE-2017-0288",
        "CVE-2017-0289",
        "CVE-2017-0294",
        "CVE-2017-0296",
        "CVE-2017-0299",
        "CVE-2017-0300",
        "CVE-2017-8462",
        "CVE-2017-8464",
        "CVE-2017-8469",
        "CVE-2017-8470",
        "CVE-2017-8471",
        "CVE-2017-8472",
        "CVE-2017-8473",
        "CVE-2017-8475",
        "CVE-2017-8476",
        "CVE-2017-8477",
        "CVE-2017-8478",
        "CVE-2017-8479",
        "CVE-2017-8480",
        "CVE-2017-8481",
        "CVE-2017-8482",
        "CVE-2017-8483",
        "CVE-2017-8484",
        "CVE-2017-8485",
        "CVE-2017-8488",
        "CVE-2017-8489",
        "CVE-2017-8491",
        "CVE-2017-8492",
        "CVE-2017-8517",
        "CVE-2017-8519",
        "CVE-2017-8527",
        "CVE-2017-8528",
        "CVE-2017-8531",
        "CVE-2017-8532",
        "CVE-2017-8533",
        "CVE-2017-8534",
        "CVE-2017-8543",
        "CVE-2017-8544",
        "CVE-2017-8553",
        "CVE-2017-8554"
      );
      script_bugtraq_id(
        97473,
        98810,
        98818,
        98819,
        98820,
        98821,
        98822,
        98824,
        98826,
        98837,
        98839,
        98842,
        98845,
        98847,
        98848,
        98849,
        98851,
        98852,
        98853,
        98854,
        98856,
        98857,
        98858,
        98859,
        98860,
        98862,
        98864,
        98865,
        98869,
        98870,
        98878,
        98884,
        98885,
        98900,
        98901,
        98903,
        98914,
        98918,
        98920,
        98922,
        98923,
        98929,
        98933,
        98940,
        98942,
        98949
      );
      script_xref(name:"MSKB", value:"3217845");
      script_xref(name:"MSFT", value:"MS17-3217845");
      script_xref(name:"MSKB", value:"4018106");
      script_xref(name:"MSFT", value:"MS17-4018106");
      script_xref(name:"MSKB", value:"4021903");
      script_xref(name:"MSFT", value:"MS17-4021903");
      script_xref(name:"MSKB", value:"4021558");
      script_xref(name:"MSFT", value:"MS17-4021558");
      script_xref(name:"MSKB", value:"4021923");
      script_xref(name:"MSFT", value:"MS17-4021923");
      script_xref(name:"MSKB", value:"4022008");
      script_xref(name:"MSFT", value:"MS17-4022008");
      script_xref(name:"MSKB", value:"4022010");
      script_xref(name:"MSFT", value:"MS17-4022010");
      script_xref(name:"MSKB", value:"4022013");
      script_xref(name:"MSFT", value:"MS17-4022013");
      script_xref(name:"MSKB", value:"4022883");
      script_xref(name:"MSFT", value:"MS17-4022883");
      script_xref(name:"MSKB", value:"4022884");
      script_xref(name:"MSFT", value:"MS17-4022884");
      script_xref(name:"MSKB", value:"4022887");
      script_xref(name:"MSFT", value:"MS17-4022887");
      script_xref(name:"MSKB", value:"4024402");
      script_xref(name:"MSFT", value:"MS17-4024402");
    
      script_name(english:"Windows 2008 June 2017 Multiple Security Updates");
      script_summary(english:"Checks the existence of Windows Server 2008 June 2017 Patches.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing multiple security updates. It is,
    therefore, affected by multiple vulnerabilities :
    
      - An information disclosure vulnerability exists when 
        affected Microsoft browsers improperly handle objects 
        in memory. An attacker who successfully exploited the 
        vulnerability could obtain information to further 
        compromise the user's system. (CVE-2016-3326)
    
      - An information disclosure vulnerability exists when 
        the Windows kernel improperly handles objects in memory. 
        An attacker who successfully exploited this vulnerability 
        could obtain information to further compromise the user's 
        system.(CVE-2017-0167)
    
      - An elevation of privilege vulnerability exists in
        Windows Hyper-V instruction emulation due to a failure
        to properly enforce privilege levels. An attacker on a
        guest operating system can exploit this to gain elevated
        privileges on the guest. Note that the host operating
        system is not vulnerable. (CVE-2017-0193)
    
      - A remote code execution vulnerability exists in
        Microsoft Office due to improper validation of
        user-supplied input before loading dynamic link library
        (DLL) files. An unauthenticated, remote attacker can
        exploit this, by convincing a user to open a specially
        crafted file, to execute arbitrary code in the context
        of the current user. (CVE-2017-0260)
    
      - Multiple information disclosure vulnerabilities exist in
        Windows Uniscribe due to improper handling of objects in
        memory. An unauthenticated, remote attacker can exploit
        these, by convincing a user to visit a specially crafted
        website or to open a specially crafted document file, to
        disclose the contents of memory. (CVE-2017-0282,
        CVE-2017-0284, CVE-2017-0285, CVE-2017-8534)
    
      - Multiple remote code execution vulnerabilities exist in
        Windows Uniscribe software due to improper handling of
        objects in memory. An unauthenticated, remote attacker
        can exploit these, by convincing a user to visit a
        specially crafted website or to open a specially crafted
        document file, to execute arbitrary code in the context
        of the current user. (CVE-2017-0283, CVE-2017-8528)
    
      - Multiple information disclosure vulnerabilities exist in
        the Windows GDI component due to improper handling of
        objects in memory. An unauthenticated, remote attacker
        can exploit these, by convincing a user to visit a
        specially crafted website or to open a specially crafted
        document file, to disclose the contents of memory.
        (CVE-2017-0287, CVE-2017-0288, CVE-2017-0289)
    
      - A remote code execution vulnerability exists in
        Microsoft Windows due to improper handling of cabinet
        files. An unauthenticated, remote attacker can exploit
        this, by convincing a user to open a specially crafted 
        cabinet file, to execute arbitrary code in the context
        of the current user. (CVE-2017-0294)
    
      - An elevation of privilege vulnerability exists in
        tdx.sys due to a failure to check the length of a buffer
        prior to copying memory to it. A local attacker can
        exploit this, via a specially crafted application, to
        execute arbitrary code in an elevated context.
        (CVE-2017-0296)
    
      - Multiple information disclosure vulnerabilities exist in
        the Windows kernel due to improper initialization of
        objects in memory. An authenticated, remote attacker can
        exploit these, via a specially crafted application, to
        disclose the base address of the kernel driver.
        (CVE-2017-0299, CVE-2017-0300, CVE-2017-8462,
        CVE-2017-8485)
    
      - A remote code execution vulnerability exists in Windows
        due to improper handling of shortcuts. An
        unauthenticated, remote attacker can exploit this, by
        convincing a user to insert a removable drive containing
        a malicious shortcut and binary, to automatically
        execute arbitrary code in the context of the current
        user. (CVE-2017-8464)
    
      - Multiple information disclosure vulnerabilities exist in
        the Windows kernel due to improper initialization of
        objects in memory. An authenticated, remote attacker can
        exploit these, via a specially crafted application, to
        disclose sensitive information. (CVE-2017-8469,
        CVE-2017-8470, CVE-2017-8471, CVE-2017-8472,
        CVE-2017-8473, CVE-2017-8475, CVE-2017-8476,
        CVE-2017-8477, CVE-2017-8478, CVE-2017-8479,
        CVE-2017-8480, CVE-2017-8481, CVE-2017-8482,
        CVE-2017-8483, CVE-2017-8484, CVE-2017-8488,
        CVE-2017-8489, CVE-2017-8491, CVE-2017-8492)
    
      - A remote code execution vulnerability exists in the way 
        JavaScript engines render when handling objects in memory 
        in Microsoft browsers. The vulnerability could corrupt 
        memory in such a way that an attacker could execute 
        arbitrary code in the context of the current user.
        (CVE-2017-8517)
    
      - A remote code execution vulnerability exists when Internet 
        Explorer improperly accesses objects in memory. This 
        vulnerability could corrupt memory in such a way that an 
        attacker could execute arbitrary code in the context of 
        the current user. (CVE-2017-8519)
    
      - A remote code execution vulnerability exists in the
        Windows font library due to improper handling of
        embedded fonts. An unauthenticated, remote attacker can
        exploit this, by convincing a user to visit a specially
        crafted website or open a specially crafted Microsoft
        document, to execute arbitrary code in the context of
        the current user. (CVE-2017-8527)
    
      - Multiple information disclosure vulnerabilities exist in
        the Windows GDI component due to improper handling of
        objects in memory. An unauthenticated, remote attacker
        can exploit these, by convincing a user to visit a
        specially crafted website or open a specially crafted
        document, to disclose the contents of memory.
        (CVE-2017-8531, CVE-2017-8532, CVE-2017-8533)
    
      - A remote code execution vulnerability exists in the
        Windows Search functionality due to improper handling of
        objects in memory. An unauthenticated, remote attacker
        can exploit this, via a specially crafted SMB message,
        to execute arbitrary code. (CVE-2017-8543)
    
      - An information disclosure vulnerability exists in the
        Windows Search functionality due to improper handling of
        objects in memory. An unauthenticated, remote attacker
        can exploit this, via a specially crafted SMB message,
        to disclose sensitive information. (CVE-2017-8544)
    
      - Multiple information disclosure vulnerabilities exist in
        the Windows kernel due to improper handling of objects
        in memory. An authenticated, remote attacker can exploit
        these, via a specially crafted application, to disclose
        the contents of memory. (CVE-2017-8553, CVE-2017-8554)");
      # https://support.microsoft.com/en-us/help/3217845/hypervisor-code-integrity-elevation-of-privilege-vulnerability
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?092d59db");
      # https://support.microsoft.com/en-us/help/4018106/microsoft-office-remote-code-execution-may-9-2017
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?254e31fd");
      # https://support.microsoft.com/en-us/help/4021558/cumulative-security-update-for-internet-explorer-june-13-2017
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f2d033c7");
      # https://support.microsoft.com/en-us/help/4021903/lnk-remote-code-execution-vulnerability-june-13-2017
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fc374e23");
      # https://support.microsoft.com/en-us/help/4021923/windows-tdx-elevation-of-privilege-vulnerability-june-13-2017
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?473a6578");
      # https://support.microsoft.com/en-us/help/4022008/windows-remote-code-execution-vulnerability-june-13-2017
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1d418d6a");
      # https://support.microsoft.com/en-us/help/4022010/windows-kernel-information-disclosure-vulnerability-june-13-2017
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?efcac01f");
      # https://support.microsoft.com/en-us/help/4022013/windows-kernel-information-disclosure-vulnerability-june-13-2017
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b34d26a1");
      # https://support.microsoft.com/en-us/help/4022883/windows-kernel-information-disclosure-vulnerability-june-13-2017
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ee2f1c8");
      script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/en-us/help/4022884/security-update-for-windows-server-2008-june-13-2017");
      # https://support.microsoft.com/en-us/help/4022884/security-update-for-windows-server-2008-june-13-2017/security-update-for-windows-server-2008-june-13-2017
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c4944e33");
      # https://support.microsoft.com/en-us/help/4024402/windows-search-vulnerabilities-in-windows-server-2008-june-13-2017
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eb6eea1d");
      script_set_attribute(attribute:"solution", value:
    "Apply the following security updates :
    
      - KB3217845
      - KB4018106
      - KB4021558
      - KB4021903
      - KB4021923
      - KB4022008
      - KB4022010
      - KB4022013
      - KB4022883
      - KB4022884
      - KB4022887
      - KB4024402");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'LNK Code Execution Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/06/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
    
      script_copyright(english:"This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.");
    
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, 'Host/patch_management_checks');
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = 'MS17-06';
    
    kbs = make_list(
      "3217845",
      "4018106",
      "4021558",
      "4021903",
      "4021923",
      "4022008",
      "4022010",
      "4022013",
      "4022883",
      "4022884",
      "4022887",
      "4024402"
    );
    
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    # KBs only apply to Windows 2008
    if (hotfix_check_sp_range(vista:'2') <= 0)
      audit(AUDIT_OS_SP_NOT_VULN);
    
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Vista" >< productname) audit(AUDIT_OS_SP_NOT_VULN);
    
    systemroot = hotfix_get_systemroot();
    if (!systemroot) audit(AUDIT_PATH_NOT_DETERMINED, 'system root');
    
    port   = kb_smb_transport();
    login  = kb_smb_login();
    pass   = kb_smb_password();
    domain = kb_smb_domain();
    
    if (hotfix_check_fversion_init() == HCF_CONNECT) exit(0, "Unable to create SMB session.");
    
    winsxs = ereg_replace(pattern:'^[A-Za-z]:(.*)', replace:"\1\WinSxS", string:systemroot);
    winsxs_share = hotfix_path2share(path:systemroot);
    
    rc = NetUseAdd(login:login, password:pass, domain:domain, share:winsxs_share);
    if (rc != 1)
    {
      NetUseDel();
      audit(AUDIT_SHARE_FAIL, winsxs_share);
    }
    
    the_session = make_array(
      'login',    login,
      'password', pass,
      'domain',   domain,
      'share',    winsxs_share
    );
    
    vuln = 0;
    
    #
    # 4024402
    files = list_dir(basedir:winsxs, level:0, dir_pat:"windowssearchengine_31bf3856ad364e35_", file_pat:"^mssrch\.dll$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('7.0.6002.19805','7.0.6002.24123'),
                                max_versions:make_list('7.0.6002.20000','7.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4024402", session:the_session);
    
    # 4021923
    files = list_dir(basedir:winsxs, level:0, dir_pat:"tdi-over-tcpip_31bf3856ad364e35_", file_pat:"^tdx\.sys$", max_recurse:1);
    vuln += hotfix_check_winsxs(os:'6.0',
                                sp:2,
                                files:files,
                                versions:make_list('6.0.6002.19787','6.0.6002.24105'),
                                max_versions:make_list('6.0.6002.20000','6.0.6002.99999'),
                                bulletin:bulletin,
                                kb:"4021923", session:the_session);
    # 3217845
    if(
      hotfix_is_vulnerable(os:"6.0", arch:"x64", sp:2, file:"hvax64.exe", version:"6.0.6002.19783", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"3217845") ||
      hotfix_is_vulnerable(os:"6.0", arch:"x64", sp:2, file:"hvax64.exe", version:"6.0.6002.24101", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"3217845")
      )
      vuln++;
    
    # 4018106
    if(
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"rundll32.exe", version:"6.0.6002.19770", min_version:"6.0.6000.16000", dir:"\system32", bulletin:bulletin, kb:"4018106") ||
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"rundll32.exe", version:"6.0.6002.24089", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4018106")
    )
      vuln++;
    
    # 4021903
    if(
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"shell32.dll", version:"6.0.6002.19785", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"4021903") ||
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"shell32.dll", version:"6.0.6002.24102", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4021903")
      )
      vuln++;
    
    # 4022008
    if(
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"win32spl.dll", version:"6.0.6002.19783", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"4022008") ||
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"win32spl.dll", version:"6.0.6002.24101", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4022008")
      )
      vuln++;
    
    # 4022010
    if(
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"msmmsp.dll", version:"6.0.6002.19784", min_version:"6.0.6000.16000", dir:"\system32", bulletin:bulletin, kb:"4022010") ||
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"msmmsp.dll", version:"6.0.6002.24102", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4022010")
      )
      vuln++;
    
    # 4022013
    if(
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"ntoskrnl.exe", version:"6.0.6002.19790", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"4022013") ||
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"ntoskrnl.exe", version:"6.0.6002.24108", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4022013")
      )
      vuln++;
    
    # 4022883
    if(hotfix_is_vulnerable(os:"6.0", sp:2, file:"atmfd.dll", version:"5.1.2.252", dir:"\system32", bulletin:bulletin, kb:"4022883"))
      vuln++;
    
    # 4022884
    if(
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"gdi32.dll", version:"6.0.6002.19787", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"4022884") ||
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"gdi32.dll", version:"6.0.6002.24105", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4022884")
      )
      vuln++;
    
    # 4022887
    if(
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"win32k.sys", version:"6.0.6002.19787", min_version:"6.0.6002.16000", dir:"\system32", bulletin:bulletin, kb:"4022887") ||
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"win32k.sys", version:"6.0.6002.24105", min_version:"6.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:"4022887")
      )
      vuln++;
    
    # 4021558
    if(
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"mshtml.dll", version:"9.0.8112.21017", min_version:"9.0.8112.20000", dir:"\system32", bulletin:bulletin, kb:"4021558") ||
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"mshtml.dll", version:"9.0.8112.16906", min_version:"9.0.8112.16000", dir:"\system32", bulletin:bulletin, kb:"4021558")
    )
      vuln++;
    
    if (vuln > 0)
    {
      replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, 'affected');
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS17_JUN_4022719.NASL
    descriptionThe remote Windows host is missing security update 4022722 or cumulative update 4022719. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows Hyper-V instruction emulation due to a failure to properly enforce privilege levels. An attacker on a guest operating system can exploit this to gain elevated privileges on the guest. Note that the host operating system is not vulnerable. (CVE-2017-0193) - A remote code execution vulnerability exists in Microsoft Office due to improper validation of user-supplied input before loading dynamic link library (DLL) files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute arbitrary code in the context of the current user. (CVE-2017-0260) - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0284, CVE-2017-0285, CVE-2017-8534) - Multiple remote code execution vulnerabilities exist in Windows Uniscribe software due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to execute arbitrary code in the context of the current user. (CVE-2017-0283, CVE-2017-8528) - Mutiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0286, CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533) - A remote code execution vulnerability exists in Microsoft Windows due to improper handling of cabinet files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted cabinet file, to execute arbitrary code in the context of the current user. (CVE-2017-0294) - An elevation of privilege vulnerability exists in tdx.sys due to a failure to check the length of a buffer prior to copying memory to it. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code in an elevated context. (CVE-2017-0296) - An elevation of privilege vulnerability exists in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code with elevated permissions. (CVE-2017-0297) - An elevation of privilege vulnerability exists in the DCOM object in Helppane.exe, when configured to run as the interactive user, due to a failure to properly authenticate the client. An authenticated, remote attacker can exploit this, via a specially crafted application, to run arbitrary code in another user
    last seen2020-05-31
    modified2017-06-13
    plugin id100761
    published2017-06-13
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100761
    titleWindows 7 and Windows Server 2008 R2 June 2017 Security Updates
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100761);
      script_version("1.21");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/28");
    
      script_cve_id(
        "CVE-2017-0193",
        "CVE-2017-0260",
        "CVE-2017-0282",
        "CVE-2017-0283",
        "CVE-2017-0284",
        "CVE-2017-0285",
        "CVE-2017-0286",
        "CVE-2017-0287",
        "CVE-2017-0288",
        "CVE-2017-0289",
        "CVE-2017-0294",
        "CVE-2017-0296",
        "CVE-2017-0297",
        "CVE-2017-0298",
        "CVE-2017-0299",
        "CVE-2017-0300",
        "CVE-2017-8462",
        "CVE-2017-8464",
        "CVE-2017-8469",
        "CVE-2017-8470",
        "CVE-2017-8471",
        "CVE-2017-8472",
        "CVE-2017-8473",
        "CVE-2017-8475",
        "CVE-2017-8476",
        "CVE-2017-8477",
        "CVE-2017-8478",
        "CVE-2017-8479",
        "CVE-2017-8480",
        "CVE-2017-8481",
        "CVE-2017-8482",
        "CVE-2017-8483",
        "CVE-2017-8484",
        "CVE-2017-8485",
        "CVE-2017-8488",
        "CVE-2017-8489",
        "CVE-2017-8490",
        "CVE-2017-8491",
        "CVE-2017-8492",
        "CVE-2017-8519",
        "CVE-2017-8524",
        "CVE-2017-8527",
        "CVE-2017-8528",
        "CVE-2017-8531",
        "CVE-2017-8532",
        "CVE-2017-8533",
        "CVE-2017-8534",
        "CVE-2017-8543",
        "CVE-2017-8544",
        "CVE-2017-8547",
        "CVE-2017-8553",
        "CVE-2017-8554"
      );
      script_bugtraq_id(
        98810,
        98818,
        98819,
        98820,
        98821,
        98822,
        98824,
        98826,
        98837,
        98839,
        98840,
        98842,
        98845,
        98847,
        98848,
        98849,
        98851,
        98852,
        98853,
        98854,
        98856,
        98857,
        98858,
        98859,
        98860,
        98862,
        98864,
        98865,
        98867,
        98869,
        98870,
        98878,
        98884,
        98885,
        98891,
        98899,
        98900,
        98901,
        98903,
        98914,
        98918,
        98920,
        98922,
        98923,
        98929,
        98930,
        98932,
        98933,
        98940,
        98942,
        98949,
        98953
      );
      script_xref(name:"MSKB", value:"4022719");
      script_xref(name:"MSFT", value:"MS17-4022719");
      script_xref(name:"MSKB", value:"4022722");
      script_xref(name:"MSFT", value:"MS17-4022722");
    
      script_name(english:"Windows 7 and Windows Server 2008 R2 June 2017 Security Updates");
      script_summary(english:"Checks for rollup.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update 4022722
    or cumulative update 4022719. It is, therefore, affected by
    multiple vulnerabilities :
    
      - An elevation of privilege vulnerability exists in
        Windows Hyper-V instruction emulation due to a failure
        to properly enforce privilege levels. An attacker on a
        guest operating system can exploit this to gain elevated
        privileges on the guest. Note that the host operating
        system is not vulnerable. (CVE-2017-0193)
    
      - A remote code execution vulnerability exists in
        Microsoft Office due to improper validation of
        user-supplied input before loading dynamic link library
        (DLL) files. An unauthenticated, remote attacker can
        exploit this, by convincing a user to open a specially
        crafted file, to execute arbitrary code in the context
        of the current user. (CVE-2017-0260)
    
      - Multiple information disclosure vulnerabilities exist in
        Windows Uniscribe due to improper handling of objects in
        memory. An unauthenticated, remote attacker can exploit
        these, by convincing a user to visit a specially crafted
        website or to open a specially crafted document file, to
        disclose the contents of memory. (CVE-2017-0282,
        CVE-2017-0284, CVE-2017-0285, CVE-2017-8534)
    
      - Multiple remote code execution vulnerabilities exist in
        Windows Uniscribe software due to improper handling of
        objects in memory. An unauthenticated, remote attacker
        can exploit these, by convincing a user to visit a
        specially crafted website or to open a specially crafted
        document file, to execute arbitrary code in the context
        of the current user. (CVE-2017-0283, CVE-2017-8528)
    
      - Mutiple information disclosure vulnerabilities exist in
        the Windows GDI component due to improper handling of
        objects in memory. An unauthenticated, remote attacker
        can exploit these, by convincing a user to visit a
        specially crafted website or to open a specially crafted
        document file, to disclose the contents of memory.
        (CVE-2017-0286, CVE-2017-0287, CVE-2017-0288,
        CVE-2017-0289, CVE-2017-8531, CVE-2017-8532,
        CVE-2017-8533)
    
      - A remote code execution vulnerability exists in
        Microsoft Windows due to improper handling of cabinet
        files. An unauthenticated, remote attacker can exploit
        this, by convincing a user to open a specially crafted
        cabinet file, to execute arbitrary code in the context
        of the current user. (CVE-2017-0294)
    
      - An elevation of privilege vulnerability exists in
        tdx.sys due to a failure to check the length of a buffer
        prior to copying memory to it. A local attacker can
        exploit this, via a specially crafted application, to
        execute arbitrary code in an elevated context.
        (CVE-2017-0296)
    
      - An elevation of privilege vulnerability exists in the
        Windows kernel due to improper handling of objects in
        memory. A local attacker can exploit this, via a
        specially crafted application, to execute arbitrary code
        with elevated permissions. (CVE-2017-0297)
    
      - An elevation of privilege vulnerability exists in the
        DCOM object in Helppane.exe, when configured to run as
        the interactive user, due to a failure to properly
        authenticate the client. An authenticated, remote
        attacker can exploit this, via a specially crafted
        application, to run arbitrary code in another user's
        session after that user has logged on to the same system
        using Terminal Services or Fast User Switching.
        (CVE-2017-0298)
    
      - Multiple information disclosure vulnerabilities exist in
        the Windows kernel due to improper initialization of
        objects in memory. An authenticated, remote attacker can
        exploit these, via a specially crafted application, to
        disclose the base address of the kernel driver.
        (CVE-2017-0299, CVE-2017-0300, CVE-2017-8462)
    
      - A remote code execution vulnerability exists in Windows
        due to improper handling of shortcuts. An
        unauthenticated, remote attacker can exploit this, by
        convincing a user to insert a removable drive containing
        a malicious shortcut and binary, to automatically
        execute arbitrary code in the context of the current
        user. (CVE-2017-8464)
    
      - Multiple information disclosure vulnerabilities exist in
        the Windows kernel due to improper initialization of
        objects in memory. An authenticated, remote attacker can
        exploit these, via a specially crafted application, to
        disclose sensitive information. (CVE-2017-8469,
        CVE-2017-8470, CVE-2017-8471, CVE-2017-8472,
        CVE-2017-8473, CVE-2017-8475, CVE-2017-8476,
        CVE-2017-8477, CVE-2017-8478, CVE-2017-8479,
        CVE-2017-8480, CVE-2017-8481, CVE-2017-8482,
        CVE-2017-8483, CVE-2017-8484, CVE-2017-8485,
        CVE-2017-8488, CVE-2017-8489, CVE-2017-8490,
        CVE-2017-8491, CVE-2017-8492)
    
      - Multiple remote code execution vulnerabilities exist in
        Internet Explorer due to improper handling of objects in
        memory. An unauthenticated, remote attacker can exploit
        these, by convincing a user to visit a specially crafted
        website, to execute arbitrary code in the context of the
        current user. (CVE-2017-8519, CVE-2017-8547)
    
      - A remote code execution vulnerability exists in
        Microsoft browsers in the JavaScript engines due to
        improper handling of objects in memory. An
        unauthenticated, remote attacker can exploit this, by
        convincing a user to visit a specially crafted website,
        to execute arbitrary code in the context of the current
        user. (CVE-2017-8524)
    
      - A remote code execution vulnerability exists in the
        Windows font library due to improper handling of
        embedded fonts. An unauthenticated, remote attacker can
        exploit this, by convincing a user to visit a specially
        crafted website or open a specially crafted Microsoft
        document, to execute arbitrary code in the context of
        the current user. (CVE-2017-8527)
    
      - A remote code execution vulnerability exists in the
        Windows Search functionality due to improper handling of
        objects in memory. An unauthenticated, remote attacker
        can exploit this, via a specially crafted SMB message,
        to execute arbitrary code. (CVE-2017-8543)
    
      - An information disclosure vulnerability exists in the
        Windows Search functionality due to improper handling of
        objects in memory. An unauthenticated, remote attacker
        can exploit this, via a specially crafted SMB message,
        to disclose sensitive information. (CVE-2017-8544)
    
      - Multiple information disclosure vulnerabilities exist in
        the Windows kernel due to improper handling of objects
        in memory. An authenticated, remote attacker can exploit
        these, via a specially crafted application, to disclose
        the contents of memory. (CVE-2017-8553, CVE-2017-8554)");
      # https://support.microsoft.com/en-us/help/4022719/windows-7-update-kb4022719
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?43db6287");
      # https://support.microsoft.com/en-us/help/4022722/windows-7-update-kb4022722
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f131905d");
      script_set_attribute(attribute:"solution", value:
    "Apply Security Only update KB4022722 or Cumulative Update KB4022719.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-8543");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'LNK Code Execution Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/06/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/13");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
    
      script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_dependencies("smb_check_rollup.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, 'Host/patch_management_checks');
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    ## NB: Microsoft
    bulletin = 'MS17-06';
    kbs = make_list("4022719", "4022722");
    
    if (get_kb_item('Host/patch_management_checks'))
      hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    # KB only applies to Window 7 / 2008 R2, SP1
    if (hotfix_check_sp_range(win7:'1') <= 0)
      audit(AUDIT_OS_SP_NOT_VULN);
    
    share = hotfix_get_systemdrive(as_share:TRUE, exit_on_fail:TRUE);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    if (
      # Windows 7 / 2008 R2
      smb_check_rollup(os:"6.1", sp:1, rollup_date:"06_2017", bulletin:bulletin, rollup_kb_list:[4022719, 4022722]))
    {
      replace_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
    }