Lucene search

K
nessusThis script is Copyright (C) 2016-2024 and is owned by Tenable, Inc. or an Affiliate thereof.FLEXERA_INSTALLSHIELD_CVE-2016-2542.NASL
HistoryMar 06, 2016 - 12:00 a.m.

Flexera InstallShield Untrusted Search Path Vulnerability

2016-03-0600:00:00
This script is Copyright (C) 2016-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
229

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

7.2 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.1%

The Flexera InstallShield application installed on the remote host is missing a vendor-supplied hotfix. It is, therefore, affected by an untrusted search path vulnerability due to looking for specific files or libraries in the current working directory, which may not be trusted or under user control. A remote attacker can exploit this, using a specially crafted DLL, by convincing a user to open a file (e.g., located on a remote WebDAV share), resulting in the injection and execution of arbitrary code.

#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(89692);
  script_version("1.11");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/19");

  script_cve_id("CVE-2016-2542");
  script_bugtraq_id(83334);
  script_xref(name:"IAVB", value:"2016-B-0040-S");

  script_name(english:"Flexera InstallShield Untrusted Search Path Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by an
untrusted search path vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Flexera InstallShield application installed on the remote host is
missing a vendor-supplied hotfix. It is, therefore, affected by an
untrusted search path vulnerability due to looking for specific files
or libraries in the current working directory, which may not be
trusted or under user control. A remote attacker can exploit this,
using a specially crafted DLL, by convincing a user to open a file
(e.g., located on a remote WebDAV share), resulting in the injection
and execution of arbitrary code.");
  # https://flexeracommunity.force.com/customer/articles/INFO/Best-Practices-to-Avoid-Windows-Setup-Launcher-Executable-Issues
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1d6580b3");
  # https://blogs.technet.microsoft.com/srd/2010/08/23/more-information-about-the-dll-preloading-remote-attack-vector/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1f913224");
  # https://blogs.flexera.com/vulnerability-management/2010/08/microsoft-windows-insecure-library-loading/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e3269c83");
  script_set_attribute(attribute:"see_also", value:"http://www.binaryplanting.com/");
  script_set_attribute(attribute:"see_also", value:"https://www.commonexploits.com/unquoted-service-paths/");
  script_set_attribute(attribute:"solution", value:
"Apply the vendor-supplied Hotfix IOJ-1745445. Note that this may
require an upgrade to InstallShield 2015 SP1. Furthermore, the vendor
recommends that InstallShield customers follow Windows best practices
when using custom actions since the hotfix is not applicable to custom
actions.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-2542");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/01/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:flexerasoftware:installshield");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2016-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("flexera_installshield_installed.nbin");
  script_require_keys("installed_sw/Flexera InstallShield");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("install_func.inc");

app = "Flexera InstallShield";
install = get_single_install(app_name:app, exit_if_unknown_ver:TRUE);
path    = install["path"];
version = install["version"];
disp_ver = install["display_version"];

# This version was obtained directly from the hotfix.
# It is not directly available to the end user via the
# application or official release notes/documentation.
# We are using it as a means to detect whether or not
# the hotfix is installed.
if (disp_ver == "22.0")
  fixed_version = "22.0.0.360";
else if (disp_ver == "21.0")
  fixed_version = "21.0.0.350";
else if (disp_ver == "20.0")
  fixed_version = "20.0.0.530";
else audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);

fix_display = "Apply InstallShield 2015 SP1 Hotfix IOJ-1745445";

if (ver_compare(fix:fixed_version, ver:version, strict:FALSE) < 0)
{
  port = get_kb_item('SMB/transport');
  if (!port) port = 445;
  report =
    '\n  Path              : ' + path +
    '\n  Installed version : ' + disp_ver +
    '\n  Fix               : ' + fix_display +
    '\n';
  security_report_v4(severity:SECURITY_HOLE, port:port, extra:report);
}
else audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);
VendorProductVersionCPE
flexerasoftwareinstallshieldcpe:/a:flexerasoftware:installshield

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

7.2 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.1%

Related for FLEXERA_INSTALLSHIELD_CVE-2016-2542.NASL