Flexera InstallShield Untrusted Search Path Vulnerability

#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(89692);
  script_version("1.11");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/19");

  script_cve_id("CVE-2016-2542");
  script_bugtraq_id(83334);
  script_xref(name:"IAVB", value:"2016-B-0040-S");

  script_name(english:"Flexera InstallShield Untrusted Search Path Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by an
untrusted search path vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Flexera InstallShield application installed on the remote host is
missing a vendor-supplied hotfix. It is, therefore, affected by an
untrusted search path vulnerability due to looking for specific files
or libraries in the current working directory, which may not be
trusted or under user control. A remote attacker can exploit this,
using a specially crafted DLL, by convincing a user to open a file
(e.g., located on a remote WebDAV share), resulting in the injection
and execution of arbitrary code.");
  # https://flexeracommunity.force.com/customer/articles/INFO/Best-Practices-to-Avoid-Windows-Setup-Launcher-Executable-Issues
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1d6580b3");
  # https://blogs.technet.microsoft.com/srd/2010/08/23/more-information-about-the-dll-preloading-remote-attack-vector/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1f913224");
  # https://blogs.flexera.com/vulnerability-management/2010/08/microsoft-windows-insecure-library-loading/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e3269c83");
  script_set_attribute(attribute:"see_also", value:"http://www.binaryplanting.com/");
  script_set_attribute(attribute:"see_also", value:"https://www.commonexploits.com/unquoted-service-paths/");
  script_set_attribute(attribute:"solution", value:
"Apply the vendor-supplied Hotfix IOJ-1745445. Note that this may
require an upgrade to InstallShield 2015 SP1. Furthermore, the vendor
recommends that InstallShield customers follow Windows best practices
when using custom actions since the hotfix is not applicable to custom
actions.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-2542");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/01/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:flexerasoftware:installshield");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2016-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("flexera_installshield_installed.nbin");
  script_require_keys("installed_sw/Flexera InstallShield");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("install_func.inc");

app = "Flexera InstallShield";
install = get_single_install(app_name:app, exit_if_unknown_ver:TRUE);
path    = install["path"];
version = install["version"];
disp_ver = install["display_version"];

# This version was obtained directly from the hotfix.
# It is not directly available to the end user via the
# application or official release notes/documentation.
# We are using it as a means to detect whether or not
# the hotfix is installed.
if (disp_ver == "22.0")
  fixed_version = "22.0.0.360";
else if (disp_ver == "21.0")
  fixed_version = "21.0.0.350";
else if (disp_ver == "20.0")
  fixed_version = "20.0.0.530";
else audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);

fix_display = "Apply InstallShield 2015 SP1 Hotfix IOJ-1745445";

if (ver_compare(fix:fixed_version, ver:version, strict:FALSE) < 0)
{
  port = get_kb_item('SMB/transport');
  if (!port) port = 445;
  report =
    '\n  Path              : ' + path +
    '\n  Installed version : ' + disp_ver +
    '\n  Fix               : ' + fix_display +
    '\n';
  security_report_v4(severity:SECURITY_HOLE, port:port, extra:report);
}
else audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);