Vulnerabilities > CVE-2018-0790 - Unspecified vulnerability in Microsoft products

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
microsoft
nessus

Summary

Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege vulnerability due to the way web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0789.

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS18_JAN_OFFICE_SHAREPOINT.NASL
descriptionThe Microsoft SharePoint Server or Microsoft Project Server installation on the remote host is missing security updates. It is, therefore, affected by the following vulnerabilities : - An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. (CVE-2018-0789, CVE-2018-0790) - A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. (CVE-2018-0792) - An Office RTF remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle RTF files. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. (CVE-2018-0797) - A cross-site-scripting (XSS) vulnerability exists when Microsoft Access does not properly sanitize inputs to image fields edited within Design view. An attacker could exploit the vulnerability by sending a specially crafted file to a victim, or by hosting the file on a web server. (CVE-2018-0799)
last seen2020-06-01
modified2020-06-02
plugin id105696
published2018-01-09
reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/105696
titleSecurity Update for Microsoft SharePoint Server (January 2018)
code
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from the Microsoft Security Updates API. The text
# itself is copyright (C) Microsoft Corporation.
#

include("compat.inc");

if (description)
{
  script_id(105696);
  script_version("1.6");
  script_cvs_date("Date: 2019/11/08");

  script_cve_id(
    "CVE-2018-0789",
    "CVE-2018-0790",
    "CVE-2018-0792",
    "CVE-2018-0797",
    "CVE-2018-0799"
  );
  script_bugtraq_id(
    102381,
    102391,
    102394,
    102406,
    102411
  );
  script_xref(name:"MSKB", value:"3114998");
  script_xref(name:"MSKB", value:"3141547");
  script_xref(name:"MSKB", value:"4011579");
  script_xref(name:"MSKB", value:"4011599");
  script_xref(name:"MSKB", value:"4011609");
  script_xref(name:"MSKB", value:"4011642");
  script_xref(name:"MSKB", value:"4011653");
  script_xref(name:"MSFT", value:"MS18-3114998");
  script_xref(name:"MSFT", value:"MS18-3141547");
  script_xref(name:"MSFT", value:"MS18-4011579");
  script_xref(name:"MSFT", value:"MS18-4011599");
  script_xref(name:"MSFT", value:"MS18-4011609");
  script_xref(name:"MSFT", value:"MS18-4011642");
  script_xref(name:"MSFT", value:"MS18-4011653");
  script_xref(name:"IAVA", value:"2018-A-0009");

  script_name(english:"Security Update for Microsoft SharePoint Server (January 2018)");
  script_summary(english:"Checks for Microsoft security update.");

  script_set_attribute(attribute:"synopsis", value:
"The Microsoft SharePoint Server or Microsoft Project Server
installation on the remote host is missing security updates.");
  script_set_attribute(attribute:"description", value:
"The Microsoft SharePoint Server or Microsoft Project Server
installation on the remote host is missing security
updates. It is, therefore, affected by the following
vulnerabilities :

  - An elevation of privilege vulnerability exists when Microsoft
    SharePoint Server does not properly sanitize a specially crafted
    web request to an affected SharePoint server. An authenticated
    attacker could exploit the vulnerability by sending a specially
    crafted request to an affected SharePoint server.
    (CVE-2018-0789, CVE-2018-0790)

  - A remote code execution vulnerability exists in Microsoft Office
    software when the software fails to properly handle objects in
    memory. An attacker who successfully exploited the vulnerability
    could run arbitrary code in the context of the current user. If
    the current user is logged on with administrative user rights, an
    attacker could take control of the affected system. An attacker
    could then install programs; view, change, or delete data; or
    create new accounts with full user rights. Users whose accounts
    are configured to have fewer user rights on the system could be
    less impacted than users who operate with administrative user
    rights. (CVE-2018-0792)

  - An Office RTF remote code execution vulnerability exists in
    Microsoft Office software when the Office software fails to
    properly handle RTF files. An attacker who successfully exploited
    the vulnerability could run arbitrary code in the context of the
    current user. If the current user is logged on with administrative
    user rights, an attacker could take control of the affected
    system. An attacker could then install programs; view, change, or
    delete data; or create new accounts with full user rights. Users
    whose accounts are configured to have fewer user rights on the
    system could be less impacted than users who operate with
    administrative user rights. (CVE-2018-0797)

  - A cross-site-scripting (XSS) vulnerability exists when Microsoft
    Access does not properly sanitize inputs to image fields edited
    within Design view. An attacker could exploit the vulnerability by
    sending a specially crafted file to a victim, or by hosting the
    file on a web server. (CVE-2018-0799)");
  # https://support.microsoft.com/en-us/help/3114998/descriptionofthesecurityupdateforsharepointserver2010january9-2018
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fd18318b");
  # https://support.microsoft.com/en-us/help/3141547/descriptionofthesecurityupdateforsharepointfoundation2010january9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0cab3ede");
  # https://support.microsoft.com/en-us/help/4011579/descriptionofthesecurityupdateforsharepointserver2013january9-2018
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c1d4a69b");
  # https://support.microsoft.com/en-us/help/4011599/descriptionofthesecurityupdateforsharepointserver2013january9-2018
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b0ca2685");
  # https://support.microsoft.com/en-us/help/4011609/descriptionofthesecurityupdateforsharepointserver2010january9-2018
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d8b7c595");
  # https://support.microsoft.com/en-us/help/4011642/descriptionofthesecurityupdateforsharepointenterpriseserver2016january
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7823ab97");
  # https://support.microsoft.com/en-us/help/4011653/descriptionofthesecurityupdateforsharepointfoundation2013january9-2018
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bf2ca8ef");
  # https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0789
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6d3749df");
  # https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0790
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?53edad91");
  # https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0792
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?54f02eaf");
  # https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0797
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9a757a23");
  # https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0799
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9007faa3");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released the following security updates to address this issue:
  - KB3114998
  - KB3141547
  - KB4011579
  - KB4011599
  - KB4011609
  - KB4011642
  - KB4011653");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0797");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/01/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/01/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/01/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_server");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_foundation");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("microsoft_sharepoint_installed.nbin", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", "microsoft_office_compatibility_pack_installed.nbin");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_reg_query.inc");
include("install_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = "MS18-01";
kbs = make_list(
  '3114998', # SharePoint Server 2010
  '3141547', # SharePoint Foundation 2010
  '4011579', # SharePoint Server 2013
  '4011599', # SharePoint Enterprise Server 2013
  '4011609', # SharePoint Server 2010
  '4011653', # SharePoint Foundation 2013
  '4011642'  # SharePoint Enterprise Server 2016
);

if (get_kb_item("Host/patch_management_checks"))
  hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/Registry/Enumerated", exit_code:1);

# Get path information for Windows.
windir = hotfix_get_systemroot();
if (isnull(windir)) exit(1, "Failed to determine the location of %windir%.");

registry_init();

var sps_2010_path, sps_2010_sp, sps_2010_edition;
var sps_2013_path, sps_2013_sp, sps_2013_edition;
var sps_2016_path, sps_2016_sp, sps_2016_edition;

vuln = FALSE;
port = kb_smb_transport();

installs = get_installs(app_name:"Microsoft SharePoint Server", exit_if_not_found:TRUE);

foreach install (installs[1])
{
  if (install["Product"] == "2010")
  {
    sps_2010_path = install['path'];
    sps_2010_sp = install['SP'];
    sps_2010_edition = install['Edition'];
  }
  else if (install["Product"] == "2013")
  {
    sps_2013_path = install['path'];
    sps_2013_sp = install['SP'];
    sps_2013_edition = install['Edition'];
  }
  else if (install["Product"] == "2016")
  {
    sps_2016_path = install['path'];
    sps_2016_sp = install['SP'];
    sps_2016_edition = install['Edition'];
  }
}

######################################################################
# SharePoint Server 2010 SP2
######################################################################
if (sps_2010_path && sps_2010_sp == "2")
{
  if (sps_2010_edition == "Server")
  {
    commonfiles = hotfix_get_commonfilesdir();
    path = hotfix_append_path(path:commonfiles, value:"Microsoft Shared\Web Server Extensions\14\ISAPI");
    if (hotfix_check_fversion(file:"microsoft.sharepoint.portal.dll", version:"14.0.7192.5000", min_version:"14.0.0.0", path:path, kb:"3114998", product:"Microsoft SharePoint Server 2010 SP2") == HCF_OLDER)
      vuln = TRUE;

    path = hotfix_append_path(path:sps_2010_path, value:"WebServices\WordServer\Core");
    if (hotfix_check_fversion(file:"sword.dll", version:"14.0.7192.5000", min_version:"14.0.0.0", path:path, kb:"4011609", product:"Microsoft SharePoint Server 2010 SP2") == HCF_OLDER)
      vuln = TRUE;
  }
  else if (sps_2010_edition == "Foundation")
  {
    commonfiles = hotfix_get_commonfilesdir();
    path = hotfix_append_path(path:commonfiles, value:"Microsoft Shared\SERVER14\Server Setup Controller");
    if (hotfix_check_fversion(file:"wsssetup.dll", version:"14.0.7184.5000", min_version:"14.0.0.0", path:path, kb:"3141547", product:"Microsoft SharePoint Foundation 2010 SP2") == HCF_OLDER)
      vuln = TRUE;
  }
}

######################################################################
# Sharepoint Server 2013 SP1
######################################################################
if (sps_2013_path && sps_2013_sp == "1")
{
  if (sps_2013_edition == "Server")
  {
    path = hotfix_append_path(path:sps_2013_path, value:"WebServices\ConversionServices");
    if (hotfix_check_fversion(file:"sword.dll", version:"15.0.4997.1000", min_version:"15.0.0.0", path:path, kb:"4011579", product:"Microsoft SharePoint Server 2013 SP1 ") == HCF_OLDER)
      vuln = TRUE;

    sysroot = hotfix_get_systemroot();
    path = hotfix_append_path(path:sysroot, value:"Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Access.Server.Application\v4.0_15.0.0.0__71e9bce111e9429c");
    if (hotfix_check_fversion(file:"Microsoft.Office.Access.Server.Application.dll", version:"15.0.4997.1000", min_version:"15.0.0.0", path:path, kb:"4011599", product:"Microsoft SharePoint Server 2013 Service Pack 1 ") == HCF_OLDER)
    {
      vuln = TRUE;
      xss = TRUE;
    }
  }
  else if (sps_2013_edition == "Foundation")
  {
    commonfiles = hotfix_get_commonfilesdir();
    path = hotfix_append_path(path:commonfiles, value:"Microsoft Shared\Web Server Extensions\15\BIN");
    if (hotfix_check_fversion(file:"onetutil.dll", version:"15.0.4997.1000", min_version:"15.0.0.0", path:path, kb:"4011653", product:"Microsoft SharePoint Foundation 2013 SP1 ") == HCF_OLDER)
      vuln = TRUE;
  }
}

######################################################################
# SharePoint Server 2016
######################################################################
if (sps_2016_path && sps_2016_sp == "0" && sps_2016_edition == "Server")
{
  path = hotfix_append_path(path:sps_2016_path, value:"WebServices\ConversionServices");
  if (hotfix_check_fversion(file:"sword.dll", version:"16.0.4639.1002", min_version:"16.0.0.0", path:path, kb:"4011642", product:"Microsoft SharePoint Server 2016") == HCF_OLDER)
  {
    vuln = TRUE;
    xss = TRUE;
  }
}

if (vuln)
{
  if (xss) replace_kb_item(name:'www/'+port+'/XSS', value:TRUE);

  replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}