| code | #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from the Microsoft Security Updates API. The text
# itself is copyright (C) Microsoft Corporation.
#
include("compat.inc");
if (description)
{
script_id(105696);
script_version("1.6");
script_cvs_date("Date: 2019/11/08");
script_cve_id(
"CVE-2018-0789",
"CVE-2018-0790",
"CVE-2018-0792",
"CVE-2018-0797",
"CVE-2018-0799"
);
script_bugtraq_id(
102381,
102391,
102394,
102406,
102411
);
script_xref(name:"MSKB", value:"3114998");
script_xref(name:"MSKB", value:"3141547");
script_xref(name:"MSKB", value:"4011579");
script_xref(name:"MSKB", value:"4011599");
script_xref(name:"MSKB", value:"4011609");
script_xref(name:"MSKB", value:"4011642");
script_xref(name:"MSKB", value:"4011653");
script_xref(name:"MSFT", value:"MS18-3114998");
script_xref(name:"MSFT", value:"MS18-3141547");
script_xref(name:"MSFT", value:"MS18-4011579");
script_xref(name:"MSFT", value:"MS18-4011599");
script_xref(name:"MSFT", value:"MS18-4011609");
script_xref(name:"MSFT", value:"MS18-4011642");
script_xref(name:"MSFT", value:"MS18-4011653");
script_xref(name:"IAVA", value:"2018-A-0009");
script_name(english:"Security Update for Microsoft SharePoint Server (January 2018)");
script_summary(english:"Checks for Microsoft security update.");
script_set_attribute(attribute:"synopsis", value:
"The Microsoft SharePoint Server or Microsoft Project Server
installation on the remote host is missing security updates.");
script_set_attribute(attribute:"description", value:
"The Microsoft SharePoint Server or Microsoft Project Server
installation on the remote host is missing security
updates. It is, therefore, affected by the following
vulnerabilities :
- An elevation of privilege vulnerability exists when Microsoft
SharePoint Server does not properly sanitize a specially crafted
web request to an affected SharePoint server. An authenticated
attacker could exploit the vulnerability by sending a specially
crafted request to an affected SharePoint server.
(CVE-2018-0789, CVE-2018-0790)
- A remote code execution vulnerability exists in Microsoft Office
software when the software fails to properly handle objects in
memory. An attacker who successfully exploited the vulnerability
could run arbitrary code in the context of the current user. If
the current user is logged on with administrative user rights, an
attacker could take control of the affected system. An attacker
could then install programs; view, change, or delete data; or
create new accounts with full user rights. Users whose accounts
are configured to have fewer user rights on the system could be
less impacted than users who operate with administrative user
rights. (CVE-2018-0792)
- An Office RTF remote code execution vulnerability exists in
Microsoft Office software when the Office software fails to
properly handle RTF files. An attacker who successfully exploited
the vulnerability could run arbitrary code in the context of the
current user. If the current user is logged on with administrative
user rights, an attacker could take control of the affected
system. An attacker could then install programs; view, change, or
delete data; or create new accounts with full user rights. Users
whose accounts are configured to have fewer user rights on the
system could be less impacted than users who operate with
administrative user rights. (CVE-2018-0797)
- A cross-site-scripting (XSS) vulnerability exists when Microsoft
Access does not properly sanitize inputs to image fields edited
within Design view. An attacker could exploit the vulnerability by
sending a specially crafted file to a victim, or by hosting the
file on a web server. (CVE-2018-0799)");
# https://support.microsoft.com/en-us/help/3114998/descriptionofthesecurityupdateforsharepointserver2010january9-2018
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fd18318b");
# https://support.microsoft.com/en-us/help/3141547/descriptionofthesecurityupdateforsharepointfoundation2010january9
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0cab3ede");
# https://support.microsoft.com/en-us/help/4011579/descriptionofthesecurityupdateforsharepointserver2013january9-2018
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c1d4a69b");
# https://support.microsoft.com/en-us/help/4011599/descriptionofthesecurityupdateforsharepointserver2013january9-2018
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b0ca2685");
# https://support.microsoft.com/en-us/help/4011609/descriptionofthesecurityupdateforsharepointserver2010january9-2018
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d8b7c595");
# https://support.microsoft.com/en-us/help/4011642/descriptionofthesecurityupdateforsharepointenterpriseserver2016january
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7823ab97");
# https://support.microsoft.com/en-us/help/4011653/descriptionofthesecurityupdateforsharepointfoundation2013january9-2018
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bf2ca8ef");
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0789
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6d3749df");
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0790
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?53edad91");
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0792
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?54f02eaf");
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0797
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9a757a23");
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0799
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9007faa3");
script_set_attribute(attribute:"solution", value:
"Microsoft has released the following security updates to address this issue:
- KB3114998
- KB3141547
- KB4011579
- KB4011599
- KB4011609
- KB4011642
- KB4011653");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0797");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2018/01/09");
script_set_attribute(attribute:"patch_publication_date", value:"2018/01/09");
script_set_attribute(attribute:"plugin_publication_date", value:"2018/01/09");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_server");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_foundation");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows : Microsoft Bulletins");
script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("microsoft_sharepoint_installed.nbin", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", "microsoft_office_compatibility_pack_installed.nbin");
script_require_keys("SMB/MS_Bulletin_Checks/Possible");
script_require_ports(139, 445, "Host/patch_management_checks");
exit(0);
}
include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_reg_query.inc");
include("install_func.inc");
get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
bulletin = "MS18-01";
kbs = make_list(
'3114998', # SharePoint Server 2010
'3141547', # SharePoint Foundation 2010
'4011579', # SharePoint Server 2013
'4011599', # SharePoint Enterprise Server 2013
'4011609', # SharePoint Server 2010
'4011653', # SharePoint Foundation 2013
'4011642' # SharePoint Enterprise Server 2016
);
if (get_kb_item("Host/patch_management_checks"))
hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
get_kb_item_or_exit("SMB/Registry/Enumerated", exit_code:1);
# Get path information for Windows.
windir = hotfix_get_systemroot();
if (isnull(windir)) exit(1, "Failed to determine the location of %windir%.");
registry_init();
var sps_2010_path, sps_2010_sp, sps_2010_edition;
var sps_2013_path, sps_2013_sp, sps_2013_edition;
var sps_2016_path, sps_2016_sp, sps_2016_edition;
vuln = FALSE;
port = kb_smb_transport();
installs = get_installs(app_name:"Microsoft SharePoint Server", exit_if_not_found:TRUE);
foreach install (installs[1])
{
if (install["Product"] == "2010")
{
sps_2010_path = install['path'];
sps_2010_sp = install['SP'];
sps_2010_edition = install['Edition'];
}
else if (install["Product"] == "2013")
{
sps_2013_path = install['path'];
sps_2013_sp = install['SP'];
sps_2013_edition = install['Edition'];
}
else if (install["Product"] == "2016")
{
sps_2016_path = install['path'];
sps_2016_sp = install['SP'];
sps_2016_edition = install['Edition'];
}
}
######################################################################
# SharePoint Server 2010 SP2
######################################################################
if (sps_2010_path && sps_2010_sp == "2")
{
if (sps_2010_edition == "Server")
{
commonfiles = hotfix_get_commonfilesdir();
path = hotfix_append_path(path:commonfiles, value:"Microsoft Shared\Web Server Extensions\14\ISAPI");
if (hotfix_check_fversion(file:"microsoft.sharepoint.portal.dll", version:"14.0.7192.5000", min_version:"14.0.0.0", path:path, kb:"3114998", product:"Microsoft SharePoint Server 2010 SP2") == HCF_OLDER)
vuln = TRUE;
path = hotfix_append_path(path:sps_2010_path, value:"WebServices\WordServer\Core");
if (hotfix_check_fversion(file:"sword.dll", version:"14.0.7192.5000", min_version:"14.0.0.0", path:path, kb:"4011609", product:"Microsoft SharePoint Server 2010 SP2") == HCF_OLDER)
vuln = TRUE;
}
else if (sps_2010_edition == "Foundation")
{
commonfiles = hotfix_get_commonfilesdir();
path = hotfix_append_path(path:commonfiles, value:"Microsoft Shared\SERVER14\Server Setup Controller");
if (hotfix_check_fversion(file:"wsssetup.dll", version:"14.0.7184.5000", min_version:"14.0.0.0", path:path, kb:"3141547", product:"Microsoft SharePoint Foundation 2010 SP2") == HCF_OLDER)
vuln = TRUE;
}
}
######################################################################
# Sharepoint Server 2013 SP1
######################################################################
if (sps_2013_path && sps_2013_sp == "1")
{
if (sps_2013_edition == "Server")
{
path = hotfix_append_path(path:sps_2013_path, value:"WebServices\ConversionServices");
if (hotfix_check_fversion(file:"sword.dll", version:"15.0.4997.1000", min_version:"15.0.0.0", path:path, kb:"4011579", product:"Microsoft SharePoint Server 2013 SP1 ") == HCF_OLDER)
vuln = TRUE;
sysroot = hotfix_get_systemroot();
path = hotfix_append_path(path:sysroot, value:"Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Access.Server.Application\v4.0_15.0.0.0__71e9bce111e9429c");
if (hotfix_check_fversion(file:"Microsoft.Office.Access.Server.Application.dll", version:"15.0.4997.1000", min_version:"15.0.0.0", path:path, kb:"4011599", product:"Microsoft SharePoint Server 2013 Service Pack 1 ") == HCF_OLDER)
{
vuln = TRUE;
xss = TRUE;
}
}
else if (sps_2013_edition == "Foundation")
{
commonfiles = hotfix_get_commonfilesdir();
path = hotfix_append_path(path:commonfiles, value:"Microsoft Shared\Web Server Extensions\15\BIN");
if (hotfix_check_fversion(file:"onetutil.dll", version:"15.0.4997.1000", min_version:"15.0.0.0", path:path, kb:"4011653", product:"Microsoft SharePoint Foundation 2013 SP1 ") == HCF_OLDER)
vuln = TRUE;
}
}
######################################################################
# SharePoint Server 2016
######################################################################
if (sps_2016_path && sps_2016_sp == "0" && sps_2016_edition == "Server")
{
path = hotfix_append_path(path:sps_2016_path, value:"WebServices\ConversionServices");
if (hotfix_check_fversion(file:"sword.dll", version:"16.0.4639.1002", min_version:"16.0.0.0", path:path, kb:"4011642", product:"Microsoft SharePoint Server 2016") == HCF_OLDER)
{
vuln = TRUE;
xss = TRUE;
}
}
if (vuln)
{
if (xss) replace_kb_item(name:'www/'+port+'/XSS', value:TRUE);
replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
hotfix_security_hole();
hotfix_check_fversion_end();
exit(0);
}
else
{
hotfix_check_fversion_end();
audit(AUDIT_HOST_NOT, 'affected');
}
|