Host missing critical security update for Microsoft Windows Secure Channel Remote Code Execution Vulnerability (2992611). Flaw in Secure Channel packets handling allows remote code execution. Affected versions include Windows 2003, Vista, Server 2008, 7, Server 2008 R2, 8, 8.1, Server 2012/R2
Source | Link |
---|---|
technet | www.technet.microsoft.com/library/security/MS14-066 |
support | www.support.microsoft.com/kb/2992611 |
securityfocus | www.securityfocus.com/bid/70954 |
# SPDX-FileCopyrightText: 2014 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.804881");
script_version("2023-07-27T05:05:08+0000");
script_cve_id("CVE-2014-6321");
script_tag(name:"cvss_base", value:"10.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_tag(name:"last_modification", value:"2023-07-27 05:05:08 +0000 (Thu, 27 Jul 2023)");
script_tag(name:"creation_date", value:"2014-11-12 12:39:54 +0530 (Wed, 12 Nov 2014)");
script_tag(name:"solution_type", value:"VendorFix");
script_name("Microsoft Windows Secure Channel Remote Code Execution Vulnerability (2992611)");
script_tag(name:"summary", value:"This host is missing a critical security
update according to Microsoft Bulletin MS14-066.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");
script_tag(name:"insight", value:"The flaw is due to an unspecified error
when handling Secure Channel packets.");
script_tag(name:"impact", value:"Successful exploitation will allow remote
attackers to execute arbitrary code.");
script_tag(name:"affected", value:"- Microsoft Windows 2003 x32/x64 Service Pack 2 and prior
- Microsoft Windows Vista x32/x64 Service Pack 2 and prior
- Microsoft Windows Server 2008 x32/x64 Service Pack 2 and prior
- Microsoft Windows 7 x32/x64 Service Pack 1 and prior
- Microsoft Windows Server 2008 R2 x64 Service Pack 1 and prior
- Microsoft Windows 8 x32/x64
- Microsoft Windows 8.1 x32/x64
- Microsoft Windows Server 2012/R2");
script_tag(name:"solution", value:"The vendor has released updates. Please see the references for more information.");
script_tag(name:"qod_type", value:"executable_version");
script_xref(name:"URL", value:"https://support.microsoft.com/kb/2992611");
script_xref(name:"URL", value:"http://www.securityfocus.com/bid/70954");
script_xref(name:"URL", value:"https://technet.microsoft.com/library/security/MS14-066");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2014 Greenbone AG");
script_family("Windows : Microsoft Bulletins");
script_dependencies("smb_reg_service_pack.nasl");
script_require_ports(139, 445);
script_mandatory_keys("SMB/WindowsVersion");
exit(0);
}
include("smb_nt.inc");
include("secpod_reg.inc");
include("version_func.inc");
include("secpod_smb_func.inc");
if(hotfix_check_sp(win2003:3, win2003x64:3, winVista:3, win7:2, win7x64:2,
win2008:3, win2008r2:2, win8:1, win8x64:1, win2012:1,
win2012R2:1, win8_1:1, win8_1x64:1) <= 0){
exit(0);
}
sysPath = smb_get_systemroot();
if(!sysPath ){
exit(0);
}
dllVer = fetch_file_version(sysPath:sysPath, file_name:"system32\Schannel.dll");
if(!dllVer){
exit(0);
}
if(hotfix_check_sp(win2003x64:3,win2003:3) > 0)
{
if(version_is_less(version:dllVer, test_version:"5.2.3790.5462")){
security_message( port: 0, data: "The target host was found to be vulnerable" );
}
exit(0);
}
## Currently not supporting for Vista and Windows Server 2008 64 bit
if(hotfix_check_sp(winVista:3, win2008:3) > 0)
{
if(version_is_less(version:dllVer, test_version:"6.0.6002.19247") ||
version_in_range(version:dllVer, test_version:"6.0.6002.23000", test_version2:"6.0.6002.23554")){
security_message( port: 0, data: "The target host was found to be vulnerable" );
}
exit(0);
}
if(hotfix_check_sp(win7:2, win7x64:2, win2008r2:2) > 0)
{
if(version_is_less(version:dllVer, test_version:"6.1.7601.18606") ||
version_in_range(version:dllVer, test_version:"6.1.7601.22000", test_version2:"6.1.7601.22813")){
security_message( port: 0, data: "The target host was found to be vulnerable" );
}
exit(0);
}
if(hotfix_check_sp(win8:1, win8x64:1, win2012:1) > 0)
{
if(version_is_less(version:dllVer, test_version:"6.2.9200.17124") ||
version_in_range(version:dllVer, test_version:"6.2.9200.20000", test_version2:"6.2.9200.21240")){
security_message( port: 0, data: "The target host was found to be vulnerable" );
}
exit(0);
}
## Win 8.1 and win2012R2
if(hotfix_check_sp(win8_1:1, win8_1x64:1, win2012R2:1) > 0)
{
if(version_is_less(version:dllVer, test_version:"6.3.9600.17385")){
security_message( port: 0, data: "The target host was found to be vulnerable" );
}
exit(0);
}
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo