Security Update for Microsoft Office Products (April 2017) (Petya) - Nessus
High Plugin ID: 99314This page contains detailed information about the Security Update for Microsoft Office Products (April 2017) (Petya) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.
Plugin Overview
ID: 99314
Name: Security Update for Microsoft Office Products (April 2017) (Petya)
Filename: smb_nt_ms17_apr_office.nasl
Vulnerability Published: 2017-04-11
This Plugin Published: 2017-04-12
Last Modification Time: 2021-11-30
Plugin Version: 1.24
Plugin Type: local
Plugin Family: Windows : Microsoft Bulletins
Dependencies:
microsoft_office_compatibility_pack_installed.nbin, microsoft_owa_installed.nbin, microsoft_sharepoint_installed.nbin, ms_bulletin_checks_possible.nasl, office_installed.nasl, onenote_installed.nbin, smb_hotfixes.nasl
Required KB Items [?]: SMB/MS_Bulletin_Checks/Possible
Vulnerability Information
Severity: High
Vulnerability Published: 2017-04-11
Patch Published: 2017-04-11
CVE [?]: CVE-2017-0106, CVE-2017-0194, CVE-2017-0195, CVE-2017-0197, CVE-2017-0199, CVE-2017-0204, CVE-2017-0207
CPE [?]: cpe:/a:microsoft:excel, cpe:/a:microsoft:office, cpe:/a:microsoft:office_compatibility_pack, cpe:/a:microsoft:office_online_server, cpe:/a:microsoft:office_web_apps, cpe:/a:microsoft:onenote, cpe:/a:microsoft:outlook, cpe:/a:microsoft:sharepoint_server
Exploited by Malware: True
In the News: True
Synopsis
An application installed on the remote Windows host is affected by multiple vulnerabilities.
Description
The Microsoft Office application, Office Web Apps, or SharePoint Server installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities :
- An arbitrary code execution vulnerability exists in Microsoft Outlook due to improper parsing of email messages. An unauthenticated, remote attacker can exploit this, via a specially crafted email message, to execute arbitrary code. (CVE-2017-0106)
- An information disclosure vulnerability exists in Microsoft Office due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted Excel file, to disclose the contents of memory. (CVE-2017-0194)
- A cross-site scripting (XSS) vulnerability exists in Office Web Apps Server due to improper validation of input before returning it to users. An authenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session. (CVE-2017-0195)
- An arbitrary code execution vulnerability exists in Microsoft Office due to improper validation of input before loading dynamic link library (DLL) files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted Office document, to execute arbitrary code. (CVE-2017-0197)
- An arbitrary code execution vulnerability exists in Microsoft Office and Windows WordPad due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute arbitrary code. Note that this vulnerability is being utilized to spread the Petya ransomware. (CVE-2017-0199)
- A security feature bypass vulnerability exists in Microsoft Office due to improper parsing of file formats. An unauthenticated, remote attacker can exploit this, by convincing a user into opening a specially crafted file, to bypass security features. (CVE-2017-0204)
- A spoofing vulnerability in Microsoft Outlook due to improper validation of input passed via HTML tags. An unauthenticated, remote attacker can exploit this, by sending an email with specific HTML tags, to display a malicious authentication prompt and gain access to a user's authentication information or login credentials. (CVE-2017-0207)
Solution
Microsoft has released a set of patches for Microsoft Office 2007, 2010, 2013, and 2016; Microsoft Excel 2007 and 2010; Microsoft OneNote 2007 and 2010; Microsoft Outlook 2007, 2010, 2013, and 2016; Microsoft Office Compatibility Pack; Excel Services on Microsoft SharePoint Server 2010 and 2013; Microsoft Excel Web App 2010; Microsoft Office Web Apps Server 2010 and 2013; and Office Online Server.
Public Exploits
Target Network Port(s): 139, 445
Target Asset(s): Host/patch_management_checks
Exploit Available: True (Metasploit Framework, Exploit-DB, GitHub, Core Impact)
Exploit Ease: Exploits are available
Here's the list of publicly known exploits and PoCs for verifying the Security Update for Microsoft Office Products (April 2017) (Petya) vulnerability:
- Metasploit: exploit/windows/fileformat/office_word_hta
[Microsoft Office Word Malicious Hta Execution] - Exploit-DB: exploits/windows/local/44263.md
[EDB-44263: Microsoft Office - 'Composite Moniker Remote Code Execution] - Exploit-DB: exploits/windows/remote/41894.py
[EDB-41894: Microsoft Word - '.RTF' Remote Code Execution] - Exploit-DB: exploits/windows/remote/41934.rb
[EDB-41934: Microsoft Office Word - '.RTF' Malicious HTA Execution (Metasploit)] - GitHub: https://github.com/ryhanson/CVE-2017-0106
[CVE-2017-0106] - GitHub: https://github.com/0xsyr0/OSCP
[CVE-2017-0199] - GitHub: https://github.com/AnonVulc/Pentest-Tools
[CVE-2017-0199] - GitHub: https://github.com/Apri1y/Red-Team-links
[CVE-2017-0199] - GitHub: https://github.com/BRAINIAC22/CVE-2017-0199
[CVE-2017-0199: A python script/generator, for generating and exploiting Microsoft vulnerability] - GitHub: https://github.com/DrVilepis/cyber-apocalypse-drvilepis
[CVE-2017-0199] - GitHub: https://github.com/Echocipher/Resource-list
[CVE-2017-0199] - GitHub: https://github.com/FlatL1neAPT/MS-Office
[CVE-2017-0199] - GitHub: https://github.com/Loveforkeeps/Lemon-Duck
[CVE-2017-0199] - GitHub: https://github.com/Nacromencer/cve2017-0199-in-python
[CVE-2017-0199] - GitHub: https://github.com/PWN-Kingdom/Test_Tasks
[CVE-2017-0199] - GitHub: https://github.com/Panopticon-Project/Panopticon-Patchwork
[CVE-2017-0199] - GitHub: https://github.com/Phantomlancer123/CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/S3cur3Th1sSh1t/Pentest-Tools
[CVE-2017-0199] - GitHub: https://github.com/SyFi/cve-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/Winter3un/cve_2017_0199
[CVE-2017-0199] - GitHub: https://github.com/bloomer1016/2017-11-17-Maldoc-Using-CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/czq945659538/-study
[CVE-2017-0199] - GitHub: https://github.com/decalage2/oletools
[CVE-2017-0199] - GitHub: https://github.com/fideliscyber/yalda
[CVE-2017-0199] - GitHub: https://github.com/gold1029/Red-Teaming-Toolkit
[CVE-2017-0199] - GitHub: https://github.com/herbiezimmerman/2017-11-17-Maldoc-Using-CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/highmeh/cvesearch
[CVE-2017-0199] - GitHub: https://github.com/houjingyi233/office-exploit-case-study
[CVE-2017-0199] - GitHub: https://github.com/hudunkey/Red-Team-links
[CVE-2017-0199] - GitHub: https://github.com/john-80/-007
[CVE-2017-0199] - GitHub: https://github.com/joke998/Cve-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/joke998/Cve-2017-0199-
[CVE-2017-0199: Cve-2017-0199] - GitHub: https://github.com/kbandla/APTnotes
[CVE-2017-0199] - GitHub: https://github.com/likescam/CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/likescam/Red-Teaming-Toolkit
[CVE-2017-0199] - GitHub: https://github.com/likescam/Red-Teaming-Toolkit_all_pentests
[CVE-2017-0199] - GitHub: https://github.com/lp008/Hack-readme
[CVE-2017-0199] - GitHub: https://github.com/mucahittopal/Pentesting-Pratic-Notes
[CVE-2017-0199] - GitHub: https://github.com/nccgroup/CVE-2017-8759
[CVE-2017-0199] - GitHub: https://github.com/ngadminq/Bei-Gai-penetration-test-guide
[CVE-2017-0199] - GitHub: https://github.com/nitishbadole/pentesting_Notes
[CVE-2017-0199] - GitHub: https://github.com/nixawk/labs
[CVE-2017-0199] - GitHub: https://github.com/oneplus-x/MS17-010
[CVE-2017-0199] - GitHub: https://github.com/papa-anniekey/CustomSignatures
[CVE-2017-0199] - GitHub: https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-0199.md
[CVE-2017-0199] - GitHub: https://github.com/qiantu88/office-cve
[CVE-2017-0199] - GitHub: https://github.com/r0eXpeR/supplier
[CVE-2017-0199] - GitHub: https://github.com/r3p3r/yeyintminthuhtut-Awesome-Red-Teaming
[CVE-2017-0199] - GitHub: https://github.com/rosetscmite/logsender
[CVE-2017-0199] - GitHub: https://github.com/ryhanson/CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/sUbc0ol/Microsoft-Word-CVE-2017-0199-
[CVE-2017-0199] - GitHub: https://github.com/seclib/oletools
[CVE-2017-0199] - GitHub: https://github.com/severnake/Pentest-Tools
[CVE-2017-0199] - GitHub: https://github.com/shr3ddersec/Shr3dKit
[CVE-2017-0199] - GitHub: https://github.com/slimdaddy/RedTeam
[CVE-2017-0199] - GitHub: https://github.com/stealth-ronin/CVE-2017-0199-PY-KIT
[CVE-2017-0199] - GitHub: https://github.com/theyoge/AD-Pentesting-Tools
[CVE-2017-0199] - GitHub: https://github.com/viethdgit/CVE-2017-0199
[CVE-2017-0199] - GitHub: https://github.com/vysecurity/RedTips
[CVE-2017-0199] - GitHub: https://github.com/xiaoZ-hc/redtool
[CVE-2017-0199] - GitHub: https://github.com/xiaoy-sec/Pentest_Note
[CVE-2017-0199] - GitHub: https://github.com/zakybstrd21215/PoC-CVE-2017-0199
[CVE-2017-0199: Exploit toolkit for vulnerability RCE Microsoft RTF] - GitHub: https://github.com/zhang040723/web
[CVE-2017-0199] - GitHub: https://github.com/ryhanson/CVE-2017-0204
[CVE-2017-0204] - GitHub: https://github.com/offensive-security/exploitdb-bin-sploits/blob/master/bin-sploits/41894.zip
[EDB-41894] - GitHub: https://github.com/offensive-security/exploitdb-bin-sploits/blob/master/bin-sploits/44263.zip
[EDB-44263] - GitHub: https://github.com/bhdresh/CVE-2017-0199
[CVE-2017-0199: Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides ...] - GitHub: https://github.com/Exploit-install/CVE-2017-0199
[CVE-2017-0199: Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick ...] - GitHub: https://github.com/haibara3839/CVE-2017-0199-master
[CVE-2017-0199] - GitHub: https://github.com/jacobsoo/RTF-Cleaner
[CVE-2017-0199: RTF Cleaner, tries to extract URL from malicious RTF samples using CVE-2017-0199 & ...] - GitHub: https://github.com/kn0wm4d/htattack
[CVE-2017-0199: An exploit implementation for RCE in RTF & DOCs (CVE-2017-0199)] - GitHub: https://github.com/mzakyz666/PoC-CVE-2017-0199
[CVE-2017-0199: Exploit toolkit for vulnerability RCE Microsoft RTF] - GitHub: https://github.com/n1shant-sinha/CVE-2017-0199
[CVE-2017-0199: Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick ...] - GitHub: https://github.com/nicpenning/RTF-Cleaner
[CVE-2017-0199: RTF de-obfuscator for CVE-2017-0199 documents to find URLs statically.] - GitHub: https://github.com/NotAwful/CVE-2017-0199-Fix
[CVE-2017-0199: Quick and dirty fix to OLE2 executing code via .hta] - GitHub: https://github.com/SwordSheath/CVE-2017-8570
[CVE-2017-0199: CVE-2017-8570生成脚本(CVE-2017-0199另一种利用方式)]
Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.
WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.
Risk Information
CVSS Score Source [?]: CVE-2017-0199
CVSS V2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:H/RL:OF/RC:C
| CVSS Base Score: | 9.3 (High) |
| Impact Subscore: | 10.0 |
| Exploitability Subscore: | 8.6 |
| CVSS Temporal Score: | 8.1 (High) |
| CVSS Environmental Score: | NA (None) |
| Modified Impact Subscore: | NA |
| Overall CVSS Score: | 8.1 (High) |
| CVSS Base Score: | 7.8 (High) |
| Impact Subscore: | 5.9 |
| Exploitability Subscore: | 1.8 |
| CVSS Temporal Score: | 7.5 (High) |
| CVSS Environmental Score: | NA (None) |
| Modified Impact Subscore: | NA |
| Overall CVSS Score: | 7.5 (High) |
STIG Risk Rating: Medium
Go back to menu.
Plugin Source
This is the smb_nt_ms17_apr_office.nasl nessus plugin source code. This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.
#
# (C) Tenable Network Security, Inc.
#
include('compat.inc');
if (description)
{
script_id(99314);
script_version("1.24");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/11/30");
script_cve_id(
"CVE-2017-0106",
"CVE-2017-0194",
"CVE-2017-0195",
"CVE-2017-0197",
"CVE-2017-0199",
"CVE-2017-0204",
"CVE-2017-0207"
);
script_bugtraq_id(
95961,
97411,
97413,
97417,
97436,
97458,
97463,
97498
);
script_xref(name:"CERT", value:"921560");
script_xref(name:"EDB-ID", value:"41894");
script_xref(name:"EDB-ID", value:"41934");
script_xref(name:"MSKB", value:"2589382");
script_xref(name:"MSFT", value:"MS17-2589382");
script_xref(name:"IAVA", value:"2017-A-0101-S");
script_xref(name:"IAVA", value:"2017-A-0104");
script_xref(name:"MSKB", value:"3101522");
script_xref(name:"MSFT", value:"MS17-3101522");
script_xref(name:"MSKB", value:"3118388");
script_xref(name:"MSFT", value:"MS17-3118388");
script_xref(name:"MSKB", value:"3127890");
script_xref(name:"MSFT", value:"MS17-3127890");
script_xref(name:"MSKB", value:"3127895");
script_xref(name:"MSFT", value:"MS17-3127895");
script_xref(name:"MSKB", value:"3141529");
script_xref(name:"MSFT", value:"MS17-3141529");
script_xref(name:"MSKB", value:"3141538");
script_xref(name:"MSFT", value:"MS17-3141538");
script_xref(name:"MSKB", value:"3172519");
script_xref(name:"MSFT", value:"MS17-3172519");
script_xref(name:"MSKB", value:"3178664");
script_xref(name:"MSFT", value:"MS17-3178664");
script_xref(name:"MSKB", value:"3178702");
script_xref(name:"MSFT", value:"MS17-3178702");
script_xref(name:"MSKB", value:"3178703");
script_xref(name:"MSFT", value:"MS17-3178703");
script_xref(name:"MSKB", value:"3178710");
script_xref(name:"MSFT", value:"MS17-3178710");
script_xref(name:"MSKB", value:"3178724");
script_xref(name:"MSFT", value:"MS17-3178724");
script_xref(name:"MSKB", value:"3178725");
script_xref(name:"MSFT", value:"MS17-3178725");
script_xref(name:"MSKB", value:"3191827");
script_xref(name:"MSFT", value:"MS17-3191827");
script_xref(name:"MSKB", value:"3191829");
script_xref(name:"MSFT", value:"MS17-3191829");
script_xref(name:"MSKB", value:"3191830");
script_xref(name:"MSFT", value:"MS17-3191830");
script_xref(name:"MSKB", value:"3191840");
script_xref(name:"MSFT", value:"MS17-3191840");
script_xref(name:"MSKB", value:"3191845");
script_xref(name:"MSFT", value:"MS17-3191845");
script_xref(name:"MSKB", value:"3191847");
script_xref(name:"MSFT", value:"MS17-3191847");
script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/05/03");
script_name(english:"Security Update for Microsoft Office Products (April 2017) (Petya)");
script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by
multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The Microsoft Office application, Office Web Apps, or SharePoint
Server installed on the remote Windows host is missing a security
update. It is, therefore, affected by multiple vulnerabilities :
- An arbitrary code execution vulnerability exists in
Microsoft Outlook due to improper parsing of email
messages. An unauthenticated, remote attacker can
exploit this, via a specially crafted email message, to
execute arbitrary code. (CVE-2017-0106)
- An information disclosure vulnerability exists in
Microsoft Office due to improper handling of objects in
memory. An unauthenticated, remote attacker can exploit
this, by convincing a user to open a specially crafted
Excel file, to disclose the contents of memory.
(CVE-2017-0194)
- A cross-site scripting (XSS) vulnerability exists in
Office Web Apps Server due to improper validation of
input before returning it to users. An authenticated,
remote attacker can exploit this, via a specially
crafted request, to execute arbitrary script code in a
user's browser session. (CVE-2017-0195)
- An arbitrary code execution vulnerability exists in
Microsoft Office due to improper validation of input
before loading dynamic link library (DLL) files. An
unauthenticated, remote attacker can exploit this, by
convincing a user to open a specially crafted Office
document, to execute arbitrary code. (CVE-2017-0197)
- An arbitrary code execution vulnerability exists in
Microsoft Office and Windows WordPad due to improper
validation of user-supplied input. An unauthenticated,
remote attacker can exploit this, by convincing a user
to open a specially crafted file, to execute arbitrary
code. Note that this vulnerability is being utilized to
spread the Petya ransomware. (CVE-2017-0199)
- A security feature bypass vulnerability exists in
Microsoft Office due to improper parsing of file
formats. An unauthenticated, remote attacker can exploit
this, by convincing a user into opening a specially
crafted file, to bypass security features.
(CVE-2017-0204)
- A spoofing vulnerability in Microsoft Outlook due to
improper validation of input passed via HTML tags. An
unauthenticated, remote attacker can exploit this, by
sending an email with specific HTML tags, to display a
malicious authentication prompt and gain access to a
user's authentication information or login credentials.
(CVE-2017-0207)");
# Removed CVE-2017-2605, as there is no longer any reference to it, or its replacement CVE-2017-1000362 in MS
# advisories, or on https://msrc.microsoft.com/
script_set_attribute(attribute:"see_also", value:"https://portal.msrc.microsoft.com/en-us/security-guidance/summary");
script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Microsoft Office 2007,
2010, 2013, and 2016; Microsoft Excel 2007 and 2010; Microsoft OneNote
2007 and 2010; Microsoft Outlook 2007, 2010, 2013, and 2016; Microsoft
Office Compatibility Pack; Excel Services on Microsoft SharePoint
Server 2010 and 2013; Microsoft Excel Web App 2010; Microsoft Office
Web Apps Server 2010 and 2013; and Office Online Server.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-0199");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploit_framework_core", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Microsoft Office Word Malicious Hta Execution');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"in_the_news", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/11");
script_set_attribute(attribute:"patch_publication_date", value:"2017/04/11");
script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/12");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:excel");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:onenote");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:outlook");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office_compatibility_pack");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office_web_apps");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office_online_server");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_server");
script_set_attribute(attribute:"stig_severity", value:"II");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows : Microsoft Bulletins");
script_copyright(english:"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("office_installed.nasl", "onenote_installed.nbin", "microsoft_sharepoint_installed.nbin", "microsoft_owa_installed.nbin", "microsoft_office_compatibility_pack_installed.nbin", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
script_require_keys("SMB/MS_Bulletin_Checks/Possible");
script_require_ports(139, 445, "Host/patch_management_checks");
exit(0);
}
include('smb_func.inc');
include('smb_hotfixes.inc');
include('smb_hotfixes_fcheck.inc');
include('smb_reg_query.inc');
include('install_func.inc');
global_var vuln;
get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
bulletin = "MS17-04";
kbs = make_list(
'2589382', # OneNote 2010 SP2
'3101522', # Excel Web App 2010 SP2
'3118388', # Outlook 2010 SP2
'3127890', # Outlook 2007 SP3
'3127895', # Office Online Server
'3141529', # Office 2007 SP3
'3141538', # Office 2010 SP2
'3172519', # Outlook 2013 SP1
'3178664', # Outlook 2016
'3178702', # Office 2016
'3178703', # Office 2016
'3178710', # Office 2013 SP1
'3178724', # Excel Services on SharePoint Server 2013
'3178725', # Office Web Apps Server 2013 SP1
'3191827', # Excel 2007 SP3
'3191829', # OneNote 2007 SP3
'3191830', # Office Compatibility Pack SP2
'3191840', # Excel Services on SharePoint Server 2010
'3191845', # Office Web Apps 2010 SP2
'3191847' # Excel 2010 SP2
);
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
get_kb_item_or_exit("SMB/Registry/Enumerated", exit_code:1);
# Get path information for Windows.
windir = hotfix_get_systemroot();
if (isnull(windir)) exit(1, "Failed to determine the location of %windir%.");
registry_init();
hklm = registry_hive_connect(hive:HKEY_LOCAL_MACHINE, exit_on_fail:TRUE);
global_var office_online_server_path = get_registry_value(
handle : hklm,
item : "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office16.WacServer\InstallLocation"
);
RegCloseKey(handle:hklm);
close_registry(close:FALSE);
vuln = FALSE;
xss = FALSE;
port = kb_smb_transport();
######################################################################
# Office 2007, 2010, 2013, 2016
######################################################################
function perform_office_checks()
{
local_var office_vers, office_sp, path, prod;
office_vers = hotfix_check_office_version();
####################################################################
# Office 2007 SP3 Checks
####################################################################
if (office_vers["12.0"])
{
office_sp = get_kb_item("SMB/Office/2007/SP");
if (!isnull(office_sp) && office_sp == 3)
{
prod = "Microsoft Office 2007 SP3";
path = hotfix_append_path(
path : hotfix_get_officecommonfilesdir(officever:"12.0"),
value : "Microsoft Shared\Office12"
);
if (hotfix_check_fversion(file:"mso.dll", version:"12.0.6766.5000", path:path, kb:"3141529", bulletin:bulletin, product:prod) == HCF_OLDER)
vuln = TRUE;
}
}
####################################################################
# Office 2010 SP2 Checks
####################################################################
if (office_vers["14.0"])
{
office_sp = get_kb_item("SMB/Office/2010/SP");
if (!isnull(office_sp) && office_sp == 2)
{
prod = "Microsoft Office 2010 SP2";
path = hotfix_append_path(
path : hotfix_get_officecommonfilesdir(officever:"14.0"),
value : "Microsoft Shared\Office14"
);
if (hotfix_check_fversion(file:"mso.dll", version:"14.0.7180.5000", path:path, kb:"3141538", bulletin:bulletin, product:prod) == HCF_OLDER)
vuln = TRUE;
}
}
####################################################################
# Office 2013 SP1 Checks
####################################################################
if (office_vers["15.0"])
{
office_sp = get_kb_item("SMB/Office/2013/SP");
if (!isnull(office_sp) && office_sp == 1)
{
prod = "Microsoft Office 2013 SP1";
path = hotfix_append_path(
path : hotfix_get_officecommonfilesdir(officever:"15.0"),
value : "Microsoft Shared\Office15"
);
if (hotfix_check_fversion(file:"mso.dll", version:"15.0.4919.1000", path:path, kb:"3178710", bulletin:bulletin, product:prod) == HCF_OLDER)
vuln = TRUE;
}
}
####################################################################
# Office 2016 Checks
####################################################################
if (office_vers["16.0"])
{
office_sp = get_kb_item("SMB/Office/2016/SP");
if (!isnull(office_sp) && office_sp == 0)
{
prod = "Microsoft Office 2016";
path = hotfix_append_path(
path:hotfix_get_officecommonfilesdir(officever:"16.0"),
value:"Microsoft Shared\Office16"
);
if (
hotfix_check_fversion(file:"mso.dll", version:"16.0.4522.1002", channel:"MSI", channel_product:"Office", path:path, kb:"3178702", bulletin:bulletin, product:prod) == HCF_OLDER ||
hotfix_check_fversion(file:"mso.dll", version:"16.0.6925.1057", channel:"Deferred", channel_product:"Office", path:path, kb:"3178702", bulletin:bulletin, product:prod) == HCF_OLDER ||
hotfix_check_fversion(file:"mso.dll", version:"16.0.7329.1051", channel:"Deferred", channel_version:"1609", channel_product:"Office", path:path, kb:"3178702", bulletin:bulletin, product:prod) == HCF_OLDER ||
hotfix_check_fversion(file:"mso.dll", version:"16.0.7726.1030", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:"3178702", bulletin:bulletin, product:prod) == HCF_OLDER ||
hotfix_check_fversion(file:"mso.dll", version:"16.0.7830.1021", channel:"Current", channel_product:"Office", path:path, kb:"3178702", bulletin:bulletin, product:prod) == HCF_OLDER
)
vuln = TRUE;
if(
hotfix_check_fversion(file:"mso30win32client.dll", version:"16.0.4522.1000", channel:"MSI", channel_product:"Office", path:path, kb:"3178703", bulletin:bulletin, product:prod) == HCF_OLDER ||
hotfix_check_fversion(file:"mso30win32client.dll", version:"16.0.6925.1057", channel:"Deferred", channel_product:"Office", path:path, kb:"3178703", bulletin:bulletin, product:prod) == HCF_OLDER ||
hotfix_check_fversion(file:"mso30win32client.dll", version:"16.0.7329.1051", channel:"Deferred", channel_version:"1609", channel_product:"Office", path:path, kb:"3178703", bulletin:bulletin, product:prod) == HCF_OLDER ||
hotfix_check_fversion(file:"mso30win32client.dll", version:"16.0.7726.1030", channel:"First Release for Deferred", channel_product:"Office", path:path, kb:"3178703", bulletin:bulletin, product:prod) == HCF_OLDER ||
hotfix_check_fversion(file:"mso30win32client.dll", version:"16.0.7830.1021", channel:"Current", channel_product:"Office", path:path, kb:"3178703", bulletin:bulletin, product:prod) == HCF_OLDER
)
vuln = TRUE;
}
}
}
######################################################################
# Excel 2007, 2010
######################################################################
function perform_excel_checks()
{
local_var excel_checks;
excel_checks = make_array(
"12.0", make_array("sp", 3, "version", "12.0.6766.5000", "kb", "3191827"),
"14.0", make_array("sp", 2, "version", "14.0.7180.5000", "kb", "3191847")
);
if (hotfix_check_office_product(product:"Excel", checks:excel_checks, bulletin:bulletin))
vuln = TRUE;
}
######################################################################
# Outlook 2007, 2010, 2013, 2016
######################################################################
function perform_outlook_checks()
{
local_var outlook_checks, kb16;
kb16 = "3178664";
outlook_checks = make_array(
"12.0", make_array("sp", 3, "version", "12.0.6767.5000", "kb", "3127890"),
"14.0", make_array("sp", 2, "version", "14.0.7180.5001", "kb", "3118388"),
"15.0", make_array("sp", 1, "version", "15.0.4919.1001", "kb", "3172519"),
"16.0", make_nested_list(
make_array("sp", 0, "version", "16.0.4522.1001", "channel", "MSI", "kb", kb16),
make_array("sp", 0, "version", "16.0.6965.2145", "channel", "Deferred", "kb", kb16),
make_array("sp", 0, "version", "16.0.7369.2127", "channel", "Deferred", "channel_version", "1609", "kb", kb16),
make_array("sp", 0, "version", "16.0.7766.2076", "channel", "First Release for Deferred", "kb", kb16),
make_array("sp", 0, "version", "16.0.7870.2038", "channel", "Current", "kb", kb16)
)
);
if (hotfix_check_office_product(product:"Outlook", checks:outlook_checks, bulletin:bulletin))
vuln = TRUE;
}
######################################################################
# OneNote 2007, 2010
######################################################################
function perform_onenote_checks()
{
var install, installs, prod, path;
installs = get_installs(app_name:'Microsoft OneNote');
if(!empty_or_null(installs))
{
foreach install (installs[1])
{
################################################################
# OneNote 2007 SP3 Checks
################################################################
if (install["product"] == "2007" && install["sp"] == 3)
{
prod = "Microsoft OneNote 2007 SP3";
path = tolower(install["path"]);
path -= "onenote.exe";
if (hotfix_check_fversion(file:"onenotesyncpc.dll", version:"12.0.6765.5000", path:path, kb:"3191829", bulletin:bulletin, product:prod) == HCF_OLDER)
vuln = TRUE;
}
################################################################
# OneNote 2010 SP2 Checks
################################################################
else if (install["product"] == "2010" && install["sp"] == 2)
{
prod = "Microsoft OneNote 2010 SP2";
path = tolower(install["path"]);
path -= "onenote.exe";
if (hotfix_check_fversion(file:"onenotesyncpc.dll", version:"14.0.7180.5000", path:path, kb:"2589382", bulletin:bulletin, product:prod) == HCF_OLDER)
vuln = TRUE;
}
}
}
}
######################################################################
# Compatibility Pack
######################################################################
function perform_comppack_checks()
{
local_var excel_compat_checks;
####################################################################
# Excel Compatibility Pack
####################################################################
excel_compat_checks = make_array(
"12.0", make_array("version", "12.0.6766.5000", "kb", "3191830")
);
if (hotfix_check_office_product(product:"ExcelCnv", display_name:"Office Compatibility Pack SP3", checks:excel_compat_checks, bulletin:bulletin))
vuln = TRUE;
}
######################################################################
# Office Web Apps 2010, 2013
######################################################################
function perform_owa_checks()
{
local_var owa_installs, owa_install;
local_var owa_2010_path, owa_2010_sp;
local_var owa_2013_path, owa_2013_sp;
local_var path;
# Get installs of Office Web Apps
owa_installs = get_installs(app_name:"Microsoft Office Web Apps");
if (!empty_or_null(owa_installs))
{
foreach owa_install (owa_installs[1])
{
if (owa_install["Product"] == "2010")
{
owa_2010_path = owa_install["path"];
owa_2010_sp = owa_install["SP"];
}
else if (owa_install["Product"] == "2013")
{
owa_2013_path = owa_install["path"];
owa_2013_sp = owa_install["SP"];
}
}
}
####################################################################
# Office Web Apps 2010 SP2
####################################################################
if (owa_2010_path && (!isnull(owa_2010_sp) && owa_2010_sp == "2"))
{
path = hotfix_append_path(path:owa_2010_path, value:"14.0\WebServices\ConversionService\Bin\Converter");
if (hotfix_check_fversion(file:"sword.dll", version:"14.0.7180.5000", min_version:"14.0.7015.1000", path:path, kb:"3191845", bulletin:bulletin, product:"Office Web Apps 2010") == HCF_OLDER)
{
vuln = TRUE;
xss = TRUE;
}
# Excel Web App
path = hotfix_append_path(path:owa_2010_path, value:"14.0\Bin");
if (hotfix_check_fversion(file:"xlsrv.dll", version:"14.0.7180.5000", path:path, kb:"3101522", bulletin:bulletin, product:"Excel Web App 2010") == HCF_OLDER)
{
vuln = TRUE;
xss = TRUE;
}
}
####################################################################
# Office Web Apps 2013 SP1
####################################################################
if (owa_2013_path && (!isnull(owa_2013_sp) && owa_2013_sp == "1"))
{
path = hotfix_append_path(path:owa_2013_path, value:"WordConversionService\bin\Converter");
if (hotfix_check_fversion(file:"sword.dll", version:"15.0.4919.1000", min_version:"15.0.4571.1500", path:path, kb:"3178725", bulletin:bulletin, product:"Office Web Apps 2013") == HCF_OLDER)
{
vuln = TRUE;
xss = TRUE;
}
}
}
######################################################################
# Office Online Server
######################################################################
function perform_oos_checks()
{
var path;
if(office_online_server_path)
{
path = hotfix_append_path(path:office_online_server_path, value:"UlsController");
if (hotfix_check_fversion(file:"uls.dll", version:"16.0.7329.1048", min_version:"16.0.6000.0", path:path, kb:"3127895", bulletin:bulletin, product:"Office Online Server") == HCF_OLDER)
{
vuln = TRUE;
xss = TRUE;
}
}
}
######################################################################
# SharePoint
######################################################################
function perform_sharepoint_checks()
{
local_var sps_2010_path, sps_2010_sp, sps_2010_edition;
local_var sps_2013_path, sps_2013_sp, sps_2013_edition;
local_var installs, install, path;
installs = get_installs(app_name:"Microsoft SharePoint Server");
foreach install (installs[1])
{
if (install["Product"] == "2013")
{
sps_2013_path = install['path'];
sps_2013_sp = install['SP'];
sps_2013_edition = install['Edition'];
}
else if (install["Product"] == "2010")
{
sps_2010_path = install['path'];
sps_2010_sp = install['SP'];
sps_2010_edition = install['Edition'];
}
}
######################################################################
# SharePoint Server 2013 SP1 - Excel Services
######################################################################
if (sps_2013_path && sps_2013_sp == "1" && sps_2013_edition == "Server")
{
path = hotfix_append_path(path:sps_2013_path, value:"Bin");
if (hotfix_check_fversion(file:"xlsrv.dll", version:"15.0.4919.1000", min_version:"15.0.0.0", path:path, kb:"3178724", bulletin:bulletin, product:"Office SharePoint Server 2013 Excel Services") == HCF_OLDER)
{
vuln = TRUE;
xss = TRUE;
}
}
######################################################################
# SharePoint Server 2010 SP2 - Word Automation Services / Excel Services
######################################################################
if (sps_2010_path && sps_2010_sp == "2" && sps_2010_edition == "Server")
{
path = hotfix_append_path(path:sps_2010_path, value:"Bin");
if (hotfix_check_fversion(file:"xlsrv.dll", version:"14.0.7180.5000", path:path, kb:"3191840", bulletin:bulletin, product:"Office SharePoint Server 2010 Excel Services") == HCF_OLDER)
{
vuln = TRUE;
xss = TRUE;
}
}
}
perform_office_checks();
perform_excel_checks();
perform_outlook_checks();
perform_onenote_checks();
perform_comppack_checks();
perform_owa_checks();
perform_oos_checks();
perform_sharepoint_checks();
if (vuln)
{
# CVE-2017-0195
if(xss) replace_kb_item(name:'www/'+port+'/XSS', value:TRUE);
replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
hotfix_security_hole();
hotfix_check_fversion_end();
exit(0);
}
else
{
hotfix_check_fversion_end();
audit(AUDIT_HOST_NOT, 'affected');
}
The latest version of this script can be found in these locations depending on your platform:
- Linux / Unix:
/opt/nessus/lib/nessus/plugins/smb_nt_ms17_apr_office.nasl - Windows:
C:\ProgramData\Tenable\Nessus\nessus\plugins\smb_nt_ms17_apr_office.nasl - Mac OS X:
/Library/Nessus/run/lib/nessus/plugins/smb_nt_ms17_apr_office.nasl
Go back to menu.
How to Run
Here is how to run the Security Update for Microsoft Office Products (April 2017) (Petya) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):
- Click to start a New Scan.
- Select Advanced Scan.
- Navigate to the Plugins tab.
- On the top right corner click to Disable All plugins.
- On the left side table select Windows : Microsoft Bulletins plugin family.
- On the right side table select Security Update for Microsoft Office Products (April 2017) (Petya) plugin ID 99314.
- Specify the target on the Settings tab and click to Save the scan.
- Run the scan.
Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.
Basic usage:
/opt/nessus/bin/nasl smb_nt_ms17_apr_office.nasl -t <IP/HOST>Run the plugin with audit trail message on the console:
/opt/nessus/bin/nasl -a smb_nt_ms17_apr_office.nasl -t <IP/HOST>Run the plugin with trace script execution written to the console (useful for debugging):
/opt/nessus/bin/nasl -T - smb_nt_ms17_apr_office.nasl -t <IP/HOST>Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):
/opt/nessus/bin/nasl -K /tmp/state smb_nt_ms17_apr_office.nasl -t <IP/HOST>Go back to menu.
References
BID | SecurityFocus Bugtraq ID: MSKB | Microsoft Knowledge Base:
- 2589382, 3101522, 3118388, 3127890, 3127895, 3141529, 3141538, 3172519, 3178664, 3178702, 3178703, 3178710, 3178724, 3178725, 3191827, 3191829, 3191830, 3191840, 3191845, 3191847
- MS17-2589382, MS17-3101522, MS17-3118388, MS17-3127890, MS17-3127895, MS17-3141529, MS17-3141538, MS17-3172519, MS17-3178664, MS17-3178702, MS17-3178703, MS17-3178710, MS17-3178724, MS17-3178725, MS17-3191827, MS17-3191829, MS17-3191830, MS17-3191840, MS17-3191845, MS17-3191847
- 2017-A-0101-S, 2017-A-0104
- https://www.tenable.com/plugins/nessus/99314
- https://portal.msrc.microsoft.com/en-us/security-guidance/summary
- https://vulners.com/nessus/SMB_NT_MS17_APR_OFFICE.NASL
- 104044 - KB4014793: Microsoft Wordpad Remote Code Execution vulnerability (April 2017)
- 99304 - Windows 7 and Windows 2008 R2 April 2017 Security Updates (Petya)
- 99285 - Windows Server 2012 April 2017 Security Updates (Petya)
- 103456 - Security Updates for Outlook (September 2017)
- 97609 - Jenkins < 2.44 / 2.32.x < 2.32.2, Jenkins Operations Center < 1.625.22.1 / 2.7.22.0.1 / 2.32.2.1, and Jenkins Enterprise < 1.651.22.1 / 2.7.22.0.1 / 2.32.2.1 Multiple Vulnerabilities
- 97833 - MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya) (uncredentialed check)
- 97737 - MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya)
Version
This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file smb_nt_ms17_apr_office.nasl version 1.24. For more plugins, visit the Nessus Plugin Library.
Go back to menu.
