Search...

Security Updates for Microsoft SharePoint Server and Microsoft Project Server (November 2017)

2017-11-15T00:00:00
ID SMB_NT_MS17_NOV_OFFICE_SHAREPOINT.NASL
Type nessus
Reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
Modified 2021-01-02T00:00:00

Description

The Microsoft SharePoint Server or Microsoft Project Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability :

  • An elevation of privilege vulnerability exists in Microsoft Project when Microsoft Project Server does not properly manage user sessions. For this Cross-site Request Forgery(CSRF/XSRF) vulnerability to be exploited, the victim must be authenticated to (logged on) the target site. (CVE-2017-11876)

  • A remote code execution vulnerability exists when a user opens a specially crafted office file. (ADV170020).

                                        
                                            #
# (C) Tenable Network Security, Inc.
#

# The descriptive text and package checks in this plugin were
# extracted from the Microsoft Security Updates API. The text
# itself is copyright (C) Microsoft Corporation.
#


include("compat.inc");

if (description)
{
  script_id(104570);
  script_version("1.8");
  script_cvs_date("Date: 2019/11/12");

  script_cve_id("CVE-2017-11876");
  script_bugtraq_id(101754);
  script_xref(name:"MSKB", value:"4011267");
  script_xref(name:"MSKB", value:"4011244");
  script_xref(name:"MSKB", value:"4011245");
  script_xref(name:"MSKB", value:"4011257");
  script_xref(name:"MSFT", value:"MS17-4011267");
  script_xref(name:"MSFT", value:"MS17-4011244");
  script_xref(name:"MSFT", value:"MS17-4011245");
  script_xref(name:"MSFT", value:"MS17-4011257");
  script_xref(name:"IAVA", value:"2017-A-0337");

  script_name(english:"Security Updates for Microsoft SharePoint Server and Microsoft Project Server (November 2017)");
  script_summary(english:"Checks for Microsoft security updates.");

  script_set_attribute(attribute:"synopsis", value:
"The Microsoft SharePoint Server or Microsoft Project Server
installation on the remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The Microsoft SharePoint Server or Microsoft Project Server
installation on the remote host is missing a security
update. It is, therefore, affected by the following
vulnerability :

  - An elevation of privilege vulnerability exists in
    Microsoft Project when Microsoft Project Server does not
    properly manage user sessions. For this Cross-site
    Request Forgery(CSRF/XSRF) vulnerability to be
    exploited, the victim must be authenticated to (logged
    on) the target site.  (CVE-2017-11876)

  - A remote code execution vulnerability exists when a
    user opens a specially crafted office file. 
    (ADV170020).");
  # https://support.microsoft.com/en-us/help/4011267/descriptionofthesecurityupdateforwordautomationservicesonsharepointser
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?441fc23d");
  # https://support.microsoft.com/en-us/help/4011244/descriptionofthesecurityupdateforsharepointserver2016november14-2017
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4fbd25b4");
  # https://support.microsoft.com/en-us/help/4011245/description-of-the-security-update-for-sharepoint-enterprise-server-20
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?42a3373f");
  # https://support.microsoft.com/en-us/help/4011257/description-of-the-security-update-for-project-server-2013-november-14
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e718850e");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released the following security updates to address this issue:  
  -KB4011267
  -KB4011244
  -KB4011245
  -KB4011257");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-11876");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/11/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/11/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/11/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:project_server");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("microsoft_sharepoint_installed.nbin", "smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl", "microsoft_office_compatibility_pack_installed.nbin");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_reg_query.inc");
include("misc_func.inc");
include("install_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = "MS17-11";
kbs = make_list(
  '4011245', # SharePoint Enterprise Server 2013 SP1 w/ word automation services
  '4011267', # SharePoint Server 2010 SP2 w/ word automation services
  '4011244', # SharePoint Enterprise Server 2016
  '4011257'  # Project Server 2013 SP1
);

if (get_kb_item("Host/patch_management_checks"))
  hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);

get_kb_item_or_exit("SMB/Registry/Enumerated", exit_code:1);

# Get path information for Windows.
windir = hotfix_get_systemroot();
if (isnull(windir)) exit(1, "Failed to determine the location of %windir%.");

registry_init();

var sps_2010_path, sps_2010_sp, sps_2010_edition;
var sps_2013_path, sps_2013_sp, sps_2013_edition;
var sps_2016_path, sps_2016_sp, sps_2016_edition;

xsrf = FALSE;
vuln = FALSE;
port = kb_smb_transport();

installs = get_installs(app_name:"Microsoft SharePoint Server", exit_if_not_found:TRUE);

foreach install (installs[1])
{
  if (install["Product"] == "2010")
  {
    sps_2010_path = install['path'];
    sps_2010_sp = install['SP'];
    sps_2010_edition = install['Edition'];
  }
  else if (install["Product"] == "2016")
  {
    sps_2016_path = install['path'];
    sps_2016_sp = install['SP'];
    sps_2016_edition = install['Edition'];
  }
  else if (install["Product"] == "2013")
  {
    sps_2013_path = install['path'];
    sps_2013_sp = install['SP'];
    sps_2013_edition = install['Edition'];
  }

}

######################################################################
# SharePoint Server 2010 SP2
######################################################################
if (sps_2010_path && sps_2010_sp == "2" && sps_2010_edition == "Server")
{
    path = hotfix_append_path(path:sps_2010_path, value:"WebServices\WordServer\Core");
    if (hotfix_check_fversion(file:"sword.dll", version:"14.0.7190.5000", min_version:"14.0.0.0", path:path, kb:"4011267", product:"Word Automation Services for SharePoint Server 2010 SP2") == HCF_OLDER)
      vuln = TRUE;
}

######################################################################
# Sharepoint Server 2013 SP1
######################################################################
if (sps_2013_path && sps_2013_sp == "1")
{
  if(sps_2013_edition == "Server")
  {
    path = hotfix_append_path(path:sps_2013_path, value:"WebServices\ConversionServices");
    if (hotfix_check_fversion(file:"msores.dll", version:"15.0.4963.1000", min_version:"15.0.0.0", path:path, kb:"4011245", product:"Microsoft SharePoint Server 2013 Service Pack 1 ") == HCF_OLDER)
      vuln = TRUE;

    # Project Server / KB 4011257
    path = hotfix_append_path(path:sps_2013_path, value:"Bin");
    if (hotfix_check_fversion(file:"Microsoft.Office.Project.Server.Library.dll", version:"15.0.4981.1000", min_version:"15.0.0.0", path:path, kb:"4011257", product:"Microsoft SharePoint Server 2013 Service Pack 1 ") == HCF_OLDER)
    {
      vuln = TRUE;
      xsrf = TRUE;
    }
  }
}

######################################################################
# SharePoint Server 2016
######################################################################
if (sps_2016_path && sps_2016_sp == "0" && sps_2016_edition == "Server")
{
  path = hotfix_append_path(path:sps_2016_path, value:"WebServices\ConversionServices");
  if (hotfix_check_fversion(file:"sword.dll", version:"16.0.4615.1000", min_version:"16.0.0.0", path:path, kb:"4011244", product:"Microsoft SharePoint Server 2016") == HCF_OLDER)
  {
    vuln = TRUE;
    xsrf = TRUE;
  }
}

if (vuln)
{
  if(xsrf) replace_kb_item(name:'www/'+port+'/XSRF', value:TRUE);

  replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);
  hotfix_security_warning();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by