Windows Server 2012 April 2017 Security Updates (Petya) - Nessus
High Plugin ID: 99285This page contains detailed information about the Windows Server 2012 April 2017 Security Updates (Petya) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.
Plugin Overview
ID: 99285
Name: Windows Server 2012 April 2017 Security Updates (Petya)
Filename: smb_nt_ms17-apr_4015551.nasl
Vulnerability Published: 2013-11-12
This Plugin Published: 2017-04-11
Last Modification Time: 2021-11-30
Plugin Version: 1.23
Plugin Type: local
Plugin Family: Windows : Microsoft Bulletins
Dependencies:
ms_bulletin_checks_possible.nasl, smb_check_rollup.nasl, smb_hotfixes.nasl
Required KB Items [?]: SMB/MS_Bulletin_Checks/Possible
Vulnerability Information
Severity: High
Vulnerability Published: 2013-11-12
Patch Published: 2017-04-11
CVE [?]: CVE-2013-6629, CVE-2017-0042, CVE-2017-0158, CVE-2017-0163, CVE-2017-0166, CVE-2017-0168, CVE-2017-0169, CVE-2017-0180, CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, CVE-2017-0185, CVE-2017-0186, CVE-2017-0188, CVE-2017-0191, CVE-2017-0192, CVE-2017-0199, CVE-2017-0201, CVE-2017-0210, CVE-2017-0211
CPE [?]: cpe:/o:microsoft:windows
Exploited by Malware: True
In the News: True
Synopsis
The remote Windows host is affected by multiple vulnerabilities.
Description
The remote Windows host is missing security update 4015548 or cumulative update 4015551. It is, therefore, affected by multiple vulnerabilities :
- An information disclosure vulnerability exists in the open-source libjpeg image processing library due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this to disclose sensitive information that can be utilized to bypass ASLR security protections. (CVE-2013-6629)
- An information disclosure vulnerability exists in Windows DirectShow due to improper handling of objects in memory. Any unauthenticated, remote attacker can exploit this, by convincing a user to visit a website with specially crafted media content, to disclose sensitive information. (CVE-2017-0042)
- Multiple information disclosure vulnerabilities exist in the win32k component due to improper handling of kernel information. A local attacker can exploit these vulnerabilities, via a specially crafted application, to disclose sensitive information. (CVE-2017-0058, CVE-2017-0188)
- Multiple flaws exist in Windows Hyper-V Network Switch due to improper validation of input from the guest operating system. A local attacker can exploit these, via a specially crafted application on the guest, to execute arbitrary code on the host system. (CVE-2017-0163, CVE-2017-0180)
- A flaw exists in LDAP due to buffer request lengths not being properly calculated. An unauthenticated, remote attacker can exploit this, via specially crafted traffic sent to a Domain Controller, to run processes with elevated privileges. (CVE-2017-0166)
- Multiple information disclosure vulnerabilities exist in Windows Hyper-V Network Switch due to improper validation of user-supplied input. A guest attacker can exploit these to disclose sensitive information on the host server. (CVE-2017-0168, CVE-2017-0169)
- Multiple denial of service vulnerabilities exist in Windows Hyper-V Network Switch due to improper validation of input from the guest operating system. A local attacker on the guest can exploit these vulnerabilities, via a specially crafted application, to crash the host system. (CVE-2017-0182, CVE-2017-0183, CVE-2017-0185, CVE-2017-0186)
- Multiple denial of service vulnerabilities exist in Hyper-V due to improper validation of input from a privileged user on a guest operating system. A local attacker on the guest can exploit these, via a specially crafted application, to cause the host system to crash. (CVE-2017-0184)
- A flaw exists in Windows due to improper handling of objects in memory that allows an attacker to cause a denial of service condition. (CVE-2017-0191)
- An information disclosure vulnerability exists in the Adobe Type Manager Font Driver (ATMFD.dll) due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted document or visit a malicious web page, to disclose sensitive information. (CVE-2017-0192)
- An arbitrary code execution vulnerability exists in Microsoft Office and Windows WordPad due to improper handling of specially crafted files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a malicious file, to execute arbitrary code in the context of the current user. Note that this vulnerability is being utilized to spread the Petya ransomware. (CVE-2017-0199)
- A memory corruption issue exists in Internet Explorer in the JScript and VBScript engines due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a malicious website, to execute arbitrary code. (CVE-2017-0201)
- A privilege escalation vulnerability exists in Internet Explorer due to a failure to properly enforce cross-domain policies. An unauthenticated, remote attacker can exploit this to inject arbitrary content and gain elevated privileges. (CVE-2017-0210)
- A privilege escalation vulnerability exists in Microsoft Windows OLE due to an unspecified failure in integrity-level checks. An authenticated, remote attacker can exploit this to run an application with limited privileges at a medium integrity level. Note that this vulnerability by itself does not allow arbitrary code execution but can be used in conjunction other vulnerabilities. (CVE-2017-0211)
Solution
Apply Security Only update KB4015548 or Cumulative update KB4015551.
Public Exploits
Target Network Port(s): 139, 445
Target Asset(s): Host/patch_management_checks
Exploit Available: True (Metasploit Framework, Exploit-DB, GitHub, Core Impact)
Exploit Ease: Exploits are available
Here's the list of publicly known exploits and PoCs for verifying the Windows Server 2012 April 2017 Security Updates (Petya) vulnerability:
- Metasploit: exploit/windows/fileformat/office_word_hta
[Microsoft Office Word Malicious Hta Execution] - Exploit-DB: exploits/windows/local/44263.md
[EDB-44263: Microsoft Office - 'Composite Moniker Remote Code Execution] - Exploit-DB: exploits/windows/remote/41894.py
[EDB-41894: Microsoft Word - '.RTF' Remote Code Execution] - Exploit-DB: exploits/windows/remote/41934.rb
[EDB-41934: Microsoft Office Word - '.RTF' Malicious HTA Execution (Metasploit)] - GitHub: https://github.com/0xsyr0/OSCP
[CVE-2017-0199] - GitHub: https://github.com/AnonVulc/Pentest-Tools
[CVE-2017-0199] - GitHub: https://github.com/Apri1y/Red-Team-links
[CVE-2017-0199] - GitHub: https://github.com/BRAINIAC22/CVE-2017-0199
[CVE-2017-0199: A python script/generator, for generating and exploiting Microsoft vulnerability] - GitHub: https://github.com/DrVilepis/cyber-apocalypse-drvilepis
[CVE-2017-0199] - GitHub: https://github.com/Echocipher/Resource-list
[CVE-2017-0199] - GitHub: https://github.com/FlatL1neAPT/MS-Office
[CVE-2017-0199] - GitHub: https://github.com/Loveforkeeps/Lemon-Duck
[CVE-2017-0199] - GitHub: https://github.com/Nacromencer/cve2017-0199-in-python
[CVE-2017-0199] - GitHub: https://github.com/PWN-Kingdom/Test_Tasks
[CVE-2017-0199] - GitHub: https://github.com/Panopticon-Project/Panopticon-Patchwork
[CVE-2017-0199] - GitHub: https://github.com/Phantomlancer123/CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/S3cur3Th1sSh1t/Pentest-Tools
[CVE-2017-0199] - GitHub: https://github.com/SyFi/cve-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/Winter3un/cve_2017_0199
[CVE-2017-0199] - GitHub: https://github.com/bloomer1016/2017-11-17-Maldoc-Using-CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/czq945659538/-study
[CVE-2017-0199] - GitHub: https://github.com/decalage2/oletools
[CVE-2017-0199] - GitHub: https://github.com/fideliscyber/yalda
[CVE-2017-0199] - GitHub: https://github.com/gold1029/Red-Teaming-Toolkit
[CVE-2017-0199] - GitHub: https://github.com/herbiezimmerman/2017-11-17-Maldoc-Using-CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/highmeh/cvesearch
[CVE-2017-0199] - GitHub: https://github.com/houjingyi233/office-exploit-case-study
[CVE-2017-0199] - GitHub: https://github.com/hudunkey/Red-Team-links
[CVE-2017-0199] - GitHub: https://github.com/john-80/-007
[CVE-2017-0199] - GitHub: https://github.com/joke998/Cve-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/joke998/Cve-2017-0199-
[CVE-2017-0199: Cve-2017-0199] - GitHub: https://github.com/kbandla/APTnotes
[CVE-2017-0199] - GitHub: https://github.com/likescam/CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/likescam/Red-Teaming-Toolkit
[CVE-2017-0199] - GitHub: https://github.com/likescam/Red-Teaming-Toolkit_all_pentests
[CVE-2017-0199] - GitHub: https://github.com/lp008/Hack-readme
[CVE-2017-0199] - GitHub: https://github.com/mucahittopal/Pentesting-Pratic-Notes
[CVE-2017-0199] - GitHub: https://github.com/nccgroup/CVE-2017-8759
[CVE-2017-0199] - GitHub: https://github.com/ngadminq/Bei-Gai-penetration-test-guide
[CVE-2017-0199] - GitHub: https://github.com/nitishbadole/pentesting_Notes
[CVE-2017-0199] - GitHub: https://github.com/nixawk/labs
[CVE-2017-0199] - GitHub: https://github.com/oneplus-x/MS17-010
[CVE-2017-0199] - GitHub: https://github.com/papa-anniekey/CustomSignatures
[CVE-2017-0199] - GitHub: https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-0199.md
[CVE-2017-0199] - GitHub: https://github.com/qiantu88/office-cve
[CVE-2017-0199] - GitHub: https://github.com/r0eXpeR/supplier
[CVE-2017-0199] - GitHub: https://github.com/r3p3r/yeyintminthuhtut-Awesome-Red-Teaming
[CVE-2017-0199] - GitHub: https://github.com/rosetscmite/logsender
[CVE-2017-0199] - GitHub: https://github.com/ryhanson/CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/sUbc0ol/Microsoft-Word-CVE-2017-0199-
[CVE-2017-0199] - GitHub: https://github.com/seclib/oletools
[CVE-2017-0199] - GitHub: https://github.com/severnake/Pentest-Tools
[CVE-2017-0199] - GitHub: https://github.com/shr3ddersec/Shr3dKit
[CVE-2017-0199] - GitHub: https://github.com/slimdaddy/RedTeam
[CVE-2017-0199] - GitHub: https://github.com/stealth-ronin/CVE-2017-0199-PY-KIT
[CVE-2017-0199] - GitHub: https://github.com/theyoge/AD-Pentesting-Tools
[CVE-2017-0199] - GitHub: https://github.com/viethdgit/CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/vysecurity/RedTips
[CVE-2017-0199] - GitHub: https://github.com/xiaoZ-hc/redtool
[CVE-2017-0199] - GitHub: https://github.com/xiaoy-sec/Pentest_Note
[CVE-2017-0199] - GitHub: https://github.com/zakybstrd21215/PoC-CVE-2017-0199
[CVE-2017-0199: Exploit toolkit for vulnerability RCE Microsoft RTF] - GitHub: https://github.com/zhang040723/web
[CVE-2017-0199] - GitHub: https://github.com/offensive-security/exploitdb-bin-sploits/blob/master/bin-sploits/41894.zip
[EDB-41894] - GitHub: https://github.com/offensive-security/exploitdb-bin-sploits/blob/master/bin-sploits/44263.zip
[EDB-44263] - GitHub: https://github.com/bhdresh/CVE-2017-0199
[CVE-2017-0199: Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides ...] - GitHub: https://github.com/Exploit-install/CVE-2017-0199
[CVE-2017-0199: Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick ...] - GitHub: https://github.com/haibara3839/CVE-2017-0199-master
[CVE-2017-0199] - GitHub: https://github.com/jacobsoo/RTF-Cleaner
[CVE-2017-0199: RTF Cleaner, tries to extract URL from malicious RTF samples using CVE-2017-0199 & ...] - GitHub: https://github.com/kn0wm4d/htattack
[CVE-2017-0199: An exploit implementation for RCE in RTF & DOCs (CVE-2017-0199)] - GitHub: https://github.com/mzakyz666/PoC-CVE-2017-0199
[CVE-2017-0199: Exploit toolkit for vulnerability RCE Microsoft RTF] - GitHub: https://github.com/n1shant-sinha/CVE-2017-0199
[CVE-2017-0199: Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick ...] - GitHub: https://github.com/nicpenning/RTF-Cleaner
[CVE-2017-0199: RTF de-obfuscator for CVE-2017-0199 documents to find URLs statically.] - GitHub: https://github.com/NotAwful/CVE-2017-0199-Fix
[CVE-2017-0199: Quick and dirty fix to OLE2 executing code via .hta] - GitHub: https://github.com/SwordSheath/CVE-2017-8570
[CVE-2017-0199: CVE-2017-8570生成脚本(CVE-2017-0199另一种利用方式)]
Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.
WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.
Risk Information
CVSS Score Source [?]: CVE-2017-0199
CVSS V2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:H/RL:OF/RC:C
CVSS Base Score: | 9.3 (High) |
Impact Subscore: | 10.0 |
Exploitability Subscore: | 8.6 |
CVSS Temporal Score: | 8.1 (High) |
CVSS Environmental Score: | NA (None) |
Modified Impact Subscore: | NA |
Overall CVSS Score: | 8.1 (High) |
CVSS Base Score: | 7.8 (High) |
Impact Subscore: | 5.9 |
Exploitability Subscore: | 1.8 |
CVSS Temporal Score: | 7.5 (High) |
CVSS Environmental Score: | NA (None) |
Modified Impact Subscore: | NA |
Overall CVSS Score: | 7.5 (High) |
STIG Risk Rating: High
Go back to menu.
Plugin Source
This is the smb_nt_ms17-apr_4015551.nasl nessus plugin source code. This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(99285);
script_version("1.23");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/11/30");
script_cve_id(
"CVE-2013-6629",
"CVE-2017-0042",
"CVE-2017-0158",
"CVE-2017-0163",
"CVE-2017-0166",
"CVE-2017-0168",
"CVE-2017-0169",
"CVE-2017-0180",
"CVE-2017-0182",
"CVE-2017-0183",
"CVE-2017-0184",
"CVE-2017-0185",
"CVE-2017-0186",
"CVE-2017-0188",
"CVE-2017-0191",
"CVE-2017-0192",
"CVE-2017-0199",
"CVE-2017-0201",
"CVE-2017-0210",
"CVE-2017-0211"
);
script_bugtraq_id(
63676,
96098,
97418,
97427,
97428,
97435,
97437,
97438,
97444,
97446,
97452,
97454,
97455,
97459,
97465,
97466,
97475,
97498,
97512,
97514
);
script_xref(name:"CERT", value:"921560");
script_xref(name:"EDB-ID", value:"41894");
script_xref(name:"EDB-ID", value:"41934");
script_xref(name:"MSKB", value:"4015548");
script_xref(name:"MSFT", value:"MS17-4015548");
script_xref(name:"IAVA", value:"2017-A-0110");
script_xref(name:"IAVA", value:"2017-A-0111");
script_xref(name:"MSKB", value:"4015551");
script_xref(name:"MSFT", value:"MS17-4015551");
script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/05/03");
script_name(english:"Windows Server 2012 April 2017 Security Updates (Petya)");
script_summary(english:"Checks for rollup.");
script_set_attribute(attribute:"synopsis", value:
"The remote Windows host is affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The remote Windows host is missing security update 4015548
or cumulative update 4015551. It is, therefore, affected by
multiple vulnerabilities :
- An information disclosure vulnerability exists in the
open-source libjpeg image processing library due to
improper handling of objects in memory. An
unauthenticated, remote attacker can exploit this to
disclose sensitive information that can be utilized to
bypass ASLR security protections. (CVE-2013-6629)
- An information disclosure vulnerability exists in
Windows DirectShow due to improper handling of objects
in memory. Any unauthenticated, remote attacker can
exploit this, by convincing a user to visit a website
with specially crafted media content, to disclose
sensitive information. (CVE-2017-0042)
- Multiple information disclosure vulnerabilities exist in
the win32k component due to improper handling of kernel
information. A local attacker can exploit these
vulnerabilities, via a specially crafted application, to
disclose sensitive information. (CVE-2017-0058,
CVE-2017-0188)
- Multiple flaws exist in Windows Hyper-V Network Switch
due to improper validation of input from the guest
operating system. A local attacker can exploit these,
via a specially crafted application on the guest, to
execute arbitrary code on the host system.
(CVE-2017-0163, CVE-2017-0180)
- A flaw exists in LDAP due to buffer request lengths not
being properly calculated. An unauthenticated, remote
attacker can exploit this, via specially crafted traffic
sent to a Domain Controller, to run processes with
elevated privileges. (CVE-2017-0166)
- Multiple information disclosure vulnerabilities exist in
Windows Hyper-V Network Switch due to improper validation
of user-supplied input. A guest attacker can exploit
these to disclose sensitive information on the host
server. (CVE-2017-0168, CVE-2017-0169)
- Multiple denial of service vulnerabilities exist in
Windows Hyper-V Network Switch due to improper
validation of input from the guest operating system. A
local attacker on the guest can exploit these
vulnerabilities, via a specially crafted application, to
crash the host system. (CVE-2017-0182, CVE-2017-0183,
CVE-2017-0185, CVE-2017-0186)
- Multiple denial of service vulnerabilities exist in
Hyper-V due to improper validation of input from a
privileged user on a guest operating system. A local
attacker on the guest can exploit these, via a specially
crafted application, to cause the host system to crash.
(CVE-2017-0184)
- A flaw exists in Windows due to improper handling of
objects in memory that allows an attacker to cause a
denial of service condition. (CVE-2017-0191)
- An information disclosure vulnerability exists in the
Adobe Type Manager Font Driver (ATMFD.dll) due to
improper handling of objects in memory. An
unauthenticated, remote attacker can exploit this, by
convincing a user to open a specially crafted document
or visit a malicious web page, to disclose sensitive
information. (CVE-2017-0192)
- An arbitrary code execution vulnerability exists in
Microsoft Office and Windows WordPad due to improper
handling of specially crafted files. An unauthenticated,
remote attacker can exploit this, by convincing a user
to open a malicious file, to execute arbitrary code in
the context of the current user. Note that this
vulnerability is being utilized to spread the Petya
ransomware. (CVE-2017-0199)
- A memory corruption issue exists in Internet
Explorer in the JScript and VBScript engines due to
improper validation of user-supplied input. An
unauthenticated, remote attacker can exploit this, by
convincing a user to visit a malicious website, to
execute arbitrary code. (CVE-2017-0201)
- A privilege escalation vulnerability exists in Internet
Explorer due to a failure to properly enforce
cross-domain policies. An unauthenticated, remote
attacker can exploit this to inject arbitrary content
and gain elevated privileges. (CVE-2017-0210)
- A privilege escalation vulnerability exists in Microsoft
Windows OLE due to an unspecified failure in
integrity-level checks. An authenticated, remote
attacker can exploit this to run an application with
limited privileges at a medium integrity level. Note
that this vulnerability by itself does not allow
arbitrary code execution but can be used in conjunction
other vulnerabilities. (CVE-2017-0211)");
# https://support.microsoft.com/en-us/help/4015551/windows-server-2012-update-kb4015551
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?782139c0");
# https://www.tenable.com/blog/petyanotpetya-ransomware-detection-for-the-modern-enterprise
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?59db5b5b");
script_set_attribute(attribute:"solution", value:
"Apply Security Only update KB4015548 or Cumulative update KB4015551.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-0199");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploit_framework_core", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Microsoft Office Word Malicious Hta Execution');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2013/11/12");
script_set_attribute(attribute:"patch_publication_date", value:"2017/04/11");
script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/11");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
script_set_attribute(attribute:"stig_severity", value:"I");
script_set_attribute(attribute:"in_the_news", value:"true");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows : Microsoft Bulletins");
script_copyright(english:"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", "smb_check_rollup.nasl");
script_require_keys("SMB/MS_Bulletin_Checks/Possible");
script_require_ports(139, 445, 'Host/patch_management_checks');
exit(0);
}
include("audit.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_hotfixes.inc");
include("smb_func.inc");
include("smb_reg_query.inc");
include("misc_func.inc");
get_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');
bulletin = 'MS17-04';
kbs = make_list(
'4015548', # 2012 Security Only
'4015551' # 2012 Monthly Rollup
);
if (get_kb_item('Host/patch_management_checks')) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit('SMB/WindowsVersion', exit_code:1);
if (hotfix_check_sp_range(win8:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
# Windows 8 EOL
productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
if ("Windows 8" >< productname && "8.1" >!< productname) audit(AUDIT_OS_SP_NOT_VULN);
share = hotfix_get_systemdrive(exit_on_fail:TRUE, as_share:TRUE);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
if ( smb_check_rollup(os:"6.2", sp:0, rollup_date: "04_2017", bulletin:bulletin, rollup_kb_list:[4015548, 4015551]) )
{
replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
hotfix_security_hole();
hotfix_check_fversion_end();
exit(0);
}
else
{
hotfix_check_fversion_end();
audit(AUDIT_HOST_NOT, hotfix_get_audit_report());
}
The latest version of this script can be found in these locations depending on your platform:
- Linux / Unix:
/opt/nessus/lib/nessus/plugins/smb_nt_ms17-apr_4015551.nasl
- Windows:
C:\ProgramData\Tenable\Nessus\nessus\plugins\smb_nt_ms17-apr_4015551.nasl
- Mac OS X:
/Library/Nessus/run/lib/nessus/plugins/smb_nt_ms17-apr_4015551.nasl
Go back to menu.
How to Run
Here is how to run the Windows Server 2012 April 2017 Security Updates (Petya) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):
- Click to start a New Scan.
- Select Advanced Scan.
- Navigate to the Plugins tab.
- On the top right corner click to Disable All plugins.
- On the left side table select Windows : Microsoft Bulletins plugin family.
- On the right side table select Windows Server 2012 April 2017 Security Updates (Petya) plugin ID 99285.
- Specify the target on the Settings tab and click to Save the scan.
- Run the scan.
Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.
Basic usage:
/opt/nessus/bin/nasl smb_nt_ms17-apr_4015551.nasl -t <IP/HOST>
Run the plugin with audit trail message on the console:
/opt/nessus/bin/nasl -a smb_nt_ms17-apr_4015551.nasl -t <IP/HOST>
Run the plugin with trace script execution written to the console (useful for debugging):
/opt/nessus/bin/nasl -T - smb_nt_ms17-apr_4015551.nasl -t <IP/HOST>
Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):
/opt/nessus/bin/nasl -K /tmp/state smb_nt_ms17-apr_4015551.nasl -t <IP/HOST>
Go back to menu.
References
BID | SecurityFocus Bugtraq ID:
- 63676, 96098, 97418, 97427, 97428, 97435, 97437, 97438, 97444, 97446, 97452, 97454, 97455, 97459, 97465, 97466, 97475, 97498, 97512, 97514
- MS17-4015548, MS17-4015551
- 2017-A-0110, 2017-A-0111
- https://www.tenable.com/plugins/nessus/99285
- http://www.nessus.org/u?59db5b5b
- http://www.nessus.org/u?782139c0
- https://vulners.com/nessus/SMB_NT_MS17-APR_4015551.NASL
- 72907 - Apple iOS < 7.1 Multiple Vulnerabilities
- 72962 - Apple TV < 6.1 Multiple Vulnerabilities
- 70986 - Debian DSA-2799-1 : chromium-browser - several vulnerabilities
- 77810 - IBM Domino 9.x < 9.0.1 Fix Pack 2 Multiple Vulnerabilities (uncredentialed check)
- 76303 - GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)
- 77811 - IBM Domino 9.0.x < 9.0.1 Fix Pack 2 Multiple Vulnerabilities (credentialed check) (POODLE)
- 77812 - IBM Notes 9.0.x < 9.0.1 Fix Pack 2 Multiple Vulnerabilities
- 72687 - Mac OS X 10.9.x < 10.9.2 Multiple Vulnerabilities
- 72688 - Mac OS X Multiple Vulnerabilities (Security Update 2014-001) (BEAST)
- 75212 - openSUSE Security Update : chromium (openSUSE-SU-2013:1776-1)
- 75213 - openSUSE Security Update : chromium (openSUSE-SU-2013:1777-1)
- 75225 - openSUSE Security Update : chromium (openSUSE-SU-2013:1861-1)
- 75366 - openSUSE Security Update : chromium (openSUSE-SU-2014:0065-1)
- 79011 - RHEL 5 / 6 : java-1.6.0-sun (RHSA-2014:0414)
- 104044 - KB4014793: Microsoft Wordpad Remote Code Execution vulnerability (April 2017)
- 99282 - KB4015219: Windows 10 Version 1511 April 2017 Cumulative Update
- 99304 - Windows 7 and Windows 2008 R2 April 2017 Security Updates (Petya)
- 99312 - Windows 8.1 and Windows Server 2012 R2 April 2017 Security Updates
- 99288 - KB4015583: Windows 10 Version 1703 April 2017 Cumulative Update
- 104889 - Security Updates for Internet Explorer (April 2017)
- 99314 - Security Update for Microsoft Office Products (April 2017) (Petya)
- 77728 - VMware Security Updates for vCenter Server (VMSA-2014-0008)
- 77630 - VMSA-2014-0008 : VMware vSphere product updates to third-party libraries
- 97833 - MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya) (uncredentialed check)
- 97737 - MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya)
Version
This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file smb_nt_ms17-apr_4015551.nasl version 1.23. For more plugins, visit the Nessus Plugin Library.
Go back to menu.