Security Updates for Microsoft Office Products (November 2017) - Nessus

High   Plugin ID: 104557

---

This page contains detailed information about the Security Updates for Microsoft Office Products (November 2017) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Plugin Overview

---

ID: 104557
Name: Security Updates for Microsoft Office Products (November 2017)
Filename: smb_nt_ms17_nov_office.nasl
Vulnerability Published: 2017-11-14
This Plugin Published: 2017-11-14
Last Modification Time: 2021-11-30
Plugin Version: 1.18
Plugin Type: local
Plugin Family: Windows : Microsoft Bulletins
Dependencies: ms_bulletin_checks_possible.nasl, office_installed.nasl, smb_hotfixes.nasl
Required KB Items [?]: SMB/MS_Bulletin_Checks/Possible

Vulnerability Information

---

Severity: High
Vulnerability Published: 2017-11-14
Patch Published: 2017-11-14
CVE [?]: CVE-2017-11854, CVE-2017-11882
CPE [?]: cpe:/a:microsoft:office
Exploited by Malware: True

Synopsis

The Microsoft Office Products are affected by multiple vulnerabilities.

Description

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities :

- Microsoft has released an update for Microsoft Office that provides enhanced security as a defense-in-depth measure.

- A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. (CVE-2017-11854)

- A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. (CVE-2017-11882)

Solution

Microsoft has released security updates for Microsoft Office Products.

Public Exploits

---

Target Network Port(s): 139, 445
Target Asset(s): Host/patch_management_checks
Exploit Available: True (Metasploit Framework, Exploit-DB, GitHub, Core Impact)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the Security Updates for Microsoft Office Products (November 2017) vulnerability:

1. Metasploit: exploit/windows/fileformat/office_ms17_11882
   [Microsoft Office CVE-2017-11882]
2. Exploit-DB: exploits/windows/remote/43163.txt
   [EDB-43163: Microsoft Office - OLE Remote Code Execution]
3. GitHub: https://github.com/404notf0und/Security-Data-Analysis-and-Visualization
   [CVE-2017-11882]
4. GitHub: https://github.com/ActorExpose/CVE-2017-11882
   [CVE-2017-11882]
5. GitHub: https://github.com/Apri1y/Red-Team-links
   [CVE-2017-11882]
6. GitHub: https://github.com/BENARBIAfiras/SophosLabs-Intelix
   [CVE-2017-11882]
7. GitHub: https://github.com/CSC-pentest/cve-2017-11882
   [CVE-2017-11882]
8. GitHub: https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections
   [CVE-2017-11882]
9. GitHub: https://github.com/CyberSift/CyberSift-Alerts
   [CVE-2017-11882]
10. GitHub: https://github.com/Echocipher/Resource-list
    [CVE-2017-11882]
11. GitHub: https://github.com/FlatL1neAPT/MS-Office
    [CVE-2017-11882]
12. GitHub: https://github.com/Flerov/WindowsExploitDev
    [CVE-2017-11882]
13. GitHub: https://github.com/Grey-Li/CVE-2017-11882
    [CVE-2017-11882]
14. GitHub: https://github.com/HacTF/poc--exp
    [CVE-2017-11882]
15. GitHub: https://github.com/HaoJame/CVE-2017-11882
    [CVE-2017-11882]
16. GitHub: https://github.com/PCsXcetra/EquationEditorShellCodeDecoder
    [CVE-2017-11882]
17. GitHub: https://github.com/PWN-Kingdom/Test_Tasks
    [CVE-2017-11882]
18. GitHub: https://github.com/PaloAltoNetworks/research-notes
    [CVE-2017-11882]
19. GitHub: https://github.com/R0fM1a/IDB_Share
    [CVE-2017-11882: CVE-2017-11882 analyse notebook]
20. GitHub: https://github.com/SewellDinG/Search
    [CVE-2017-11882]
21. GitHub: https://github.com/SexyBeast233/SecBooks
    [CVE-2017-11882]
22. GitHub: https://github.com/Shadowshusky/CVE-2017-11882-
    [CVE-2017-11882]
23. GitHub: https://github.com/Spacial/awesome-csirt
    [CVE-2017-11882]
24. GitHub: https://github.com/StrangerealIntel/DeltaFlare
    [CVE-2017-11882]
25. GitHub: https://github.com/bloomer1016/CVE-2017-11882-Possible-Remcos-Malspam
    [CVE-2017-11882]
26. GitHub: https://github.com/chanbin/CVE-2017-11882
    [CVE-2017-11882: Microsoft Equation 3.0/Convert python2 to python3]
27. GitHub: https://github.com/cranelab/exploit-development
    [CVE-2017-11882]
28. GitHub: https://github.com/czq945659538/-study
    [CVE-2017-11882]
29. GitHub: https://github.com/dactoankmapydev/crawler0121
    [CVE-2017-11882]
30. GitHub: https://github.com/edeca/rtfraptor
    [CVE-2017-11882]
31. GitHub: https://github.com/emaan122/Note2
    [CVE-2017-11882]
32. GitHub: https://github.com/eric-erki/APT_CyberCriminal_Campagin_Collections
    [CVE-2017-11882]
33. GitHub: https://github.com/fengjixuchui/RedTeamer
    [CVE-2017-11882]
34. GitHub: https://github.com/gold1029/Red-Teaming-Toolkit
    [CVE-2017-11882]
35. GitHub: https://github.com/herbiezimmerman/CVE-2017-11882-Possible-Remcos-Malspam
    [CVE-2017-11882]
36. GitHub: https://github.com/houjingyi233/office-exploit-case-study
    [CVE-2017-11882]
37. GitHub: https://github.com/hudunkey/Red-Team-links
    [CVE-2017-11882]
38. GitHub: https://github.com/iwarsong/apt
    [CVE-2017-11882]
39. GitHub: https://github.com/j0lama/CVE-2017-11882
    [CVE-2017-11882]
40. GitHub: https://github.com/jaychouzzk/-
    [CVE-2017-11882]
41. GitHub: https://github.com/john-80/-007
    [CVE-2017-11882]
42. GitHub: https://github.com/jstrosch/malware-samples
    [CVE-2017-11882]
43. GitHub: https://github.com/jvdroit/APT_CyberCriminal_Campagin_Collections
    [CVE-2017-11882]
44. GitHub: https://github.com/legendsec/CVE-2017-11882-for-Kali
    [CVE-2017-11882: # CVE-2017-11882-metasploit This is a Metasploit module which exploits ...]
45. GitHub: https://github.com/letiencong96/CVE_2017_11882
    [CVE-2017-11882: CVE_2017_11882]
46. GitHub: https://github.com/likescam/APT_CyberCriminal_Campagin_Collections
    [CVE-2017-11882]
47. GitHub: https://github.com/likescam/CVE-2017-11882
    [CVE-2017-11882]
48. GitHub: https://github.com/likescam/CVE-2018-0802_CVE-2017-11882
    [CVE-2017-11882]
49. GitHub: https://github.com/likescam/CyberMonitor-APT_CyberCriminal_Campagin_Collections
    [CVE-2017-11882]
50. GitHub: https://github.com/likescam/Red-Teaming-Toolkit
    [CVE-2017-11882]
51. GitHub: https://github.com/likescam/Red-Teaming-Toolkit_all_pentests
    [CVE-2017-11882]
52. GitHub: https://github.com/lisinan988/CVE-2017-11882-exp
    [CVE-2017-11882]
53. GitHub: https://github.com/lp008/Hack-readme
    [CVE-2017-11882]
54. GitHub: https://github.com/mucahittopal/Pentesting-Pratic-Notes
    [CVE-2017-11882]
55. GitHub: https://github.com/nitishbadole/pentesting_Notes
    [CVE-2017-11882]
56. GitHub: https://github.com/pandazheng/Threat-Intelligence-Analyst
    [CVE-2017-11882]
57. GitHub: https://github.com/qiantu88/office-cve
    [CVE-2017-11882]
58. GitHub: https://github.com/qy1202/https-github.com-Ridter-CVE-2017-11882-
    [CVE-2017-11882]
59. GitHub: https://github.com/r0eXpeR/supplier
    [CVE-2017-11882]
60. GitHub: https://github.com/shr3ddersec/Shr3dKit
    [CVE-2017-11882]
61. GitHub: https://github.com/slimdaddy/RedTeam
    [CVE-2017-11882]
62. GitHub: https://github.com/sumas/APT_CyberCriminal_Campagin_Collections
    [CVE-2017-11882]
63. GitHub: https://github.com/tingsama/hacking-p2
    [CVE-2017-11882]
64. GitHub: https://github.com/tzwlhack/CVE-2017-11882
    [CVE-2017-11882]
65. GitHub: https://github.com/wateroot/poc-exp
    [CVE-2017-11882]
66. GitHub: https://github.com/wrlu/Vulnerabilities
    [CVE-2017-11882]
67. GitHub: https://github.com/wzxmt/CVE-2017
    [CVE-2017-11882]
68. GitHub: https://github.com/xiaoZ-hc/redtool
    [CVE-2017-11882]
69. GitHub: https://github.com/xiaoy-sec/Pentest_Note
    [CVE-2017-11882]
70. GitHub: https://github.com/zhang040723/web
    [CVE-2017-11882]
71. GitHub: https://github.com/zhouat/cve-2017-11882
    [CVE-2017-11882]
72. GitHub: https://github.com/offensive-security/exploitdb-bin-sploits/blob/master/bin-sploits/43163.zip
    [EDB-43163]
73. GitHub: https://github.com/0x09AL/CVE-2017-11882-metasploit
    [CVE-2017-11882: This is a Metasploit module which exploits CVE-2017-11882 using the POC released ...]
74. GitHub: https://github.com/BlackMathIT/2017-11882_Generator
    [CVE-2017-11882: CVE-2017-11882 File Generator PoC]
75. GitHub: https://github.com/ChaitanyaHaritash/CVE-2017-11882
    [CVE-2017-11882: Empire Port of CVE-2017-11882]
76. GitHub: https://github.com/dcsync/rtfkit
    [CVE-2017-11882: Generate RTF exploit payload. uses cve-2017-11882, cve-2017-8570, cve-2018-0802, and ...]
77. GitHub: https://github.com/ekgg/Overflow-Demo-CVE-2017-11882
    [CVE-2017-11882: Simple Overflow demo, like CVE-2017-11882 exp]
78. GitHub: https://github.com/embedi/CVE-2017-11882
    [CVE-2017-11882: Proof-of-Concept exploits for CVE-2017-11882]
79. GitHub: https://github.com/HZachev/ABC
    [CVE-2017-11882]
80. GitHub: https://github.com/littlebin404/CVE-2017-11882
    [CVE-2017-11882: CVE-2017-11882（通杀Office 2003到2016）]
81. GitHub: https://github.com/Retr0-code/SignHere
    [CVE-2017-11882: SignHere is implementation of CVE-2017-11882. SignHere is builder of malicious rtf ...]
82. GitHub: https://github.com/Ridter/CVE-2017-11882
    [CVE-2017-11882: CVE-2017-11882 from https://github.com/embedi/CVE-2017-11882]
83. GitHub: https://github.com/Ridter/RTF_11882_0802
    [CVE-2017-11882: PoC for CVE-2018-0802 And CVE-2017-11882]
84. GitHub: https://github.com/rxwx/CVE-2018-0802
    [CVE-2017-11882: PoC Exploit for CVE-2018-0802 (and optionally CVE-2017-11882)]
85. GitHub: https://github.com/starnightcyber/CVE-2017-11882
    [CVE-2017-11882: CVE-2017-11882 exploitation]
86. GitHub: https://github.com/unamer/CVE-2017-11882
    [CVE-2017-11882: CVE-2017-11882 Exploit accepts over 17k bytes long command/code in maximum.]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

---

CVSS Score Source [?]: CVE-2017-11882
CVSS V2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:H/RL:OF/RC:C

CVSS Base Score:	9.3 (High)
Impact Subscore:	10.0
Exploitability Subscore:	8.6
CVSS Temporal Score:	8.1 (High)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	8.1 (High)

CVSS V3 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

CVSS Base Score:	7.8 (High)
Impact Subscore:	5.9
Exploitability Subscore:	1.8
CVSS Temporal Score:	7.5 (High)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	7.5 (High)

STIG Severity [?]: II
STIG Risk Rating: Medium

Go back to menu.

Plugin Source

---

This is the smb_nt_ms17_nov_office.nasl nessus plugin source code. This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from the Microsoft Security Updates API. The text
# itself is copyright (C) Microsoft Corporation.
#

include("compat.inc");

if (description)
{
  script_id(104557);
  script_version("1.18");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/11/30");

  script_cve_id("CVE-2017-11854", "CVE-2017-11882");
  script_bugtraq_id(101746, 101757);
  script_xref(name:"MSKB", value:"3162047");
  script_xref(name:"MSKB", value:"4011268");
  script_xref(name:"MSKB", value:"4011604");
  script_xref(name:"MSKB", value:"4011262");
  script_xref(name:"MSKB", value:"4011618");
  script_xref(name:"MSFT", value:"MS17-3162047");
  script_xref(name:"MSFT", value:"MS17-4011268");
  script_xref(name:"MSFT", value:"MS17-4011604");
  script_xref(name:"MSFT", value:"MS17-4011262");
  script_xref(name:"MSFT", value:"MS17-4011618");
  script_xref(name:"IAVA", value:"2017-A-0337-S");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/05/03");

  script_name(english:"Security Updates for Microsoft Office Products (November 2017)");
  script_summary(english:"Checks for Microsoft security updates.");

  script_set_attribute(attribute:"synopsis", value:
"The Microsoft Office Products are affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The Microsoft Office Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - Microsoft has released an update for Microsoft Office that
    provides enhanced security as a defense-in-depth measure.

  - A remote code execution vulnerability exists in Microsoft Office
    software when the software fails to properly handle objects in
    memory. An attacker who successfully exploited the vulnerability
    could run arbitrary code in the context of the current user. If
    the current user is logged on with administrative user rights, an
    attacker could take control of the affected system. An attacker
    could then install programs; view, change, or delete data; or
    create new accounts with full user rights. Users whose accounts
    are configured to have fewer user rights on the system could be
    less impacted than users who operate with administrative user
    rights. (CVE-2017-11854)

  - A remote code execution vulnerability exists in Microsoft Office
    software when the software fails to properly handle objects in
    memory. An attacker who successfully exploited the vulnerability
    could run arbitrary code in the context of the current user. If
    the current user is logged on with administrative user rights, an
    attacker could take control of the affected system. An attacker
    could then install programs; view, change, or delete data; or
    create new accounts with full user rights. Users whose accounts
    are configured to have fewer user rights on the system could be
    less impacted than users who operate with administrative user
    rights. (CVE-2017-11882)");
  # https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170020
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0f1b55d1");
  # https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11854
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7c504489");
  # https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?df348bb4");
  # https://support.microsoft.com/en-us/help/3162047/descriptionofthesecurityupdateforoffice2013november14-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4a238ff7");
  # https://support.microsoft.com/en-us/help/4011276/descriptionofthesecurityupdatefor2007microsoftofficesuitenovember14-20
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b3ad665b");
  # https://support.microsoft.com/en-us/help/4011262/descriptionofthesecurityupdateforoffice2016november14-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ddf439cf");
  # https://support.microsoft.com/en-us/help/2553204/description-of-the-security-update-for-office-2010-november-14-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1df91bdd");
  # https://support.microsoft.com/en-us/help/4011268/descriptionofthesecurityupdateforoffice2010november14-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5199de26");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released security updates for Microsoft Office Products.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-11882");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Microsoft Office CVE-2017-11882');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/11/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/11/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/11/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("office_installed.nasl", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_reg_query.inc");
include("misc_func.inc");
include("install_func.inc");

global_var vuln;

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = "MS17-11";
kbs = make_list(
  '4011604', # Office 2007 SP3
  '4011618', # Office 2010 SP2
  '4011268', # Office 2010 SP2
  '3162047', # Office 2013 SP1
  '4011262'  # Office 2016
);

if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);

get_kb_item_or_exit("SMB/Registry/Enumerated", exit_code:1);

vuln = FALSE;
port = kb_smb_transport();

######################################################################
# Office 2007, 2010, 2013, 2016
######################################################################
function perform_office_checks()
{
  local_var office_vers, office_sp, common_path, path, prod, file, kb;
  office_vers = hotfix_check_office_version();

  ####################################################################
  # Office 2007 SP3 Checks
  ####################################################################
  if (office_vers["12.0"])
  {
    office_sp = get_kb_item("SMB/Office/2007/SP");
    if (!isnull(office_sp) && office_sp == 3)
    {
      prod = "Microsoft Office 2007 SP3";
      common_path = hotfix_get_officecommonfilesdir(officever:"12.0");

      path = hotfix_append_path(
               path  : common_path,
               value : "Microsoft Shared\Equation"
      );
      if (hotfix_check_fversion(file:"eqnedt32.exe", version:"2017.8.14.0", path:path, kb:"4011604", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;
    }
  }

  ####################################################################
  # Office 2010 SP2 Checks
  ####################################################################
  if (office_vers["14.0"])
  {
    office_sp = get_kb_item("SMB/Office/2010/SP");
    if (!isnull(office_sp) && office_sp == 2)
    {
      prod = "Microsoft Office 2010 SP2";
      common_path = hotfix_get_officecommonfilesdir(officever:"14.0");

      path = hotfix_append_path(
        path  : common_path,
        value : "Microsoft Shared\Equation"
      );
      if (hotfix_check_fversion(file:"eqnedt32.exe", version:"2017.8.14.0", path:path, kb:"4011618", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;

      path = hotfix_append_path(
        path  : common_path,
        value : "Microsoft Shared\Office14"
      );
      if (hotfix_check_fversion(file:"wwlibcxm.dll", version:"14.0.7190.5000", path:path, kb:"4011268", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;
    }
  }

  ####################################################################
  # Office 2013 SP1 Checks
  ####################################################################
  if (office_vers["15.0"])
  {
    office_sp = get_kb_item("SMB/Office/2013/SP");
    if (!isnull(office_sp) && office_sp == 1)
    {
      prod = "Microsoft Office 2013 SP1";
      common_path = hotfix_get_officecommonfilesdir(officever:"15.0");

      path = hotfix_append_path(
        path  : common_path,
        value : "Microsoft Shared\Equation"
      );
      if (hotfix_check_fversion(file:"eqnedt32.exe", version:"2017.8.14.0", path:path, kb:"3162047", bulletin:bulletin, product:prod) == HCF_OLDER)
        vuln = TRUE;
    }
  }

  ####################################################################
  # Office 2016 Checks
  ####################################################################
  if (office_vers["16.0"])
  {
    office_sp = get_kb_item("SMB/Office/2016/SP");
    if (!isnull(office_sp) && office_sp == 0)
    {
      prod = "Microsoft Office 2016";
      common_path = hotfix_get_officecommonfilesdir(officever:"16.0");

      path = hotfix_append_path(
        path  : common_path,
        value : "Microsoft Shared\Equation"
      );
      kb   = "4011262";
      file = "eqnedt32.exe";
      if (
        hotfix_check_fversion(file:file, version:"2017.8.14.0", channel:"MSI", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"2017.8.14.0", channel:"Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"2017.8.14.0", channel:"Deferred", channel_version:"1705", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"2017.8.14.0", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER ||
        hotfix_check_fversion(file:file, version:"2017.8.14.0", channel:"Current", channel_product:"Office", path:path, kb:kb, bulletin:bulletin, product:prod) == HCF_OLDER
      )
        vuln = TRUE;
    }
  }
}

######################################################################
# MAIN
######################################################################
perform_office_checks();

if (vuln)
{
  replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}

The latest version of this script can be found in these locations depending on your platform:

• Linux / Unix:
  /opt/nessus/lib/nessus/plugins/smb_nt_ms17_nov_office.nasl
• Windows:
  C:\ProgramData\Tenable\Nessus\nessus\plugins\smb_nt_ms17_nov_office.nasl
• Mac OS X:
  /Library/Nessus/run/lib/nessus/plugins/smb_nt_ms17_nov_office.nasl

Go back to menu.

How to Run

---

Here is how to run the Security Updates for Microsoft Office Products (November 2017) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

1. Click to start a New Scan.
2. Select Advanced Scan.
3. Navigate to the Plugins tab.
4. On the top right corner click to Disable All plugins.
5. On the left side table select Windows : Microsoft Bulletins plugin family.
6. On the right side table select Security Updates for Microsoft Office Products (November 2017) plugin ID 104557.
7. Specify the target on the Settings tab and click to Save the scan.
8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl smb_nt_ms17_nov_office.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a smb_nt_ms17_nov_office.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - smb_nt_ms17_nov_office.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state smb_nt_ms17_nov_office.nasl -t <IP/HOST>

Go back to menu.

References

---

BID | SecurityFocus Bugtraq ID:

• 101746, 101757

MSKB | Microsoft Knowledge Base:

• 3162047, 4011262, 4011268, 4011604, 4011618

MSFT | Microsoft Security Bulletin:

• MS17-3162047, MS17-4011262, MS17-4011268, MS17-4011604, MS17-4011618

IAVA | Information Assurance Vulnerability Alert:

• 2017-A-0337-S

See also:

• https://www.tenable.com/plugins/nessus/104557
• http://www.nessus.org/u?0f1b55d1
• http://www.nessus.org/u?1df91bdd
• http://www.nessus.org/u?4a238ff7
• http://www.nessus.org/u?7c504489
• http://www.nessus.org/u?5199de26
• http://www.nessus.org/u?b3ad665b
• http://www.nessus.org/u?ddf439cf
• http://www.nessus.org/u?df348bb4
• https://vulners.com/nessus/SMB_NT_MS17_NOV_OFFICE.NASL

Similar and related Nessus plugins:

• 104548 - KB4048952: Windows 10 Version 1511 November 2017 Cumulative Update
• 104549 - KB4048953: Windows 10 Version 1607 and Windows Server 2016 November 2017 Cumulative Update
• 104550 - KB4048954: Windows 10 Version 1703 November 2017 Cumulative Update
• 104551 - KB4048955: Windows 10 Version 1709 and Windows Server Version 1709 November 2017 Cumulative Update
• 104552 - KB4048956: Windows 10 LTSB November 2017 Cumulative Update
• 104553 - Windows 7 and Windows Server 2008 R2 November 2017 Security Updates
• 104554 - Windows 8.1 and Windows Server 2012 R2 November 2017 Security Updates
• 104555 - Windows Server 2012 November 2017 Security Updates
• 104894 - Security Updates for Internet Explorer (November 2017)
• 104561 - Windows 2008 November 2017 Multiple Security Updates

Version

---

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file smb_nt_ms17_nov_office.nasl version 1.18. For more plugins, visit the Nessus Plugin Library.

Go back to menu.