Microsoft Autorun Arbitrary Code Execution Vulnerability (08-038)

###############################################################################
# OpenVAS Vulnerability Test
# $Id: secpod_ms08-038.nasl 5934 2017-04-11 12:28:28Z antu123 $
#
# Microsoft Autorun Arbitrary Code Execution Vulnerability (08-038)
#
# Authors:
# Sujit Ghosal <[email protected]>
#
# Updated By: Madhuri D <[email protected]> on 2010-12-16
#         - To detect 'shell32.dll' file version on vista, win 2008
#
# Copyright:
# Copyright (c) 2009 SecPod, http://www.secpod.com
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2
# (or any later version), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
###############################################################################

if(description)
{
  script_id(900445);
  script_version("$Revision: 5934 $");
  script_tag(name:"last_modification", value:"$Date: 2017-04-11 14:28:28 +0200 (Tue, 11 Apr 2017) $");
  script_tag(name:"creation_date", value:"2009-02-02 05:02:24 +0100 (Mon, 02 Feb 2009)");
  script_tag(name:"cvss_base", value:"9.3");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_cve_id("CVE-2009-0243", "CVE-2008-0951");
  script_bugtraq_id(28360);
  script_name("Microsoft Autorun Arbitrary Code Execution Vulnerability (08-038)");


  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2009 SecPod");
  script_family("Windows");
  script_dependencies("secpod_reg_enum.nasl");
  script_require_ports(139, 445);
  script_mandatory_keys("SMB/WindowsVersion");

  script_tag(name : "impact" , value : "Successful exploitation will let the attacker execute arbitrary codes in the
  context of the affected Windows system and can gain sensitive information or
  can make the system resources completely unavailable.
  Impact Level: System/Network");
  script_tag(name : "affected" , value : "Microsoft Windows 2K SP4 / XP SP2 / 2003 SP2 and prior.
  Microsoft Windows Vista Service Pack 1 and prior
  Microsoft Windows Server 2008 Service Pack 1 and prior");
  script_tag(name : "insight" , value : "MS Windows OSes are not able to enforce the 'Autorun' and 'NoDriveTypeAutoRun'
  registry values. Allows physically proximate attackers to execute malicious
  code by inserting CD-ROM media, inserting DVD media, connecting a USB device,
  connecting a Firewire device, by mapping a network drive, by clicking on an
  icon under My Computer\Devices with Removable Storage and AutoPlay dialog
  related to the Autorun.inf file.");
  script_tag(name : "solution" , value : "Apply the security patch (KB950582).
  http://www.microsoft.com/downloads/results.aspx?pocId=7&freetext=KB950582&DisplayLang=en");
  script_tag(name : "summary" , value : "This host is running Windows Operating System and is prone to
  Autorun Arbitrary Code Execution Vulnerability.");
  script_tag(name:"qod_type", value:"registry");
  script_tag(name:"solution_type", value:"VendorFix");
  script_xref(name : "URL" , value : "http://secunia.com/advisories/29458");
  script_xref(name : "URL" , value : "http://support.microsoft.com/kb/953252");
  script_xref(name : "URL" , value : "http://isc.sans.org/diary.html?storyid=5695");
  script_xref(name : "URL" , value : "http://www.us-cert.gov/cas/techalerts/TA09-020A.html");
  exit(0);
}


include("smb_nt.inc");
include("secpod_reg.inc");
include("version_func.inc");
include("secpod_smb_func.inc");

if(hotfix_check_sp(win2k:5, xp:4, win2003:3, win2008:2, winVista:2) <= 0){
  exit(0);
}

if(hotfix_missing(name:"950582") == 0){
  exit(0);
}

## Get System32 path
sysPath = smb_get_system32root();
if(sysPath)
{
  shellVer = fetch_file_version(sysPath, file_name:"shell32.dll");
  if(shellVer)
  {
    # Windows 2000
    if(hotfix_check_sp(win2k:5) > 0)
    {
      # Grep for shell32.dll version < 5.0.3900.7155
      if(version_is_less(version:shellVer, test_version:"5.0.3900.7155")){
        security_message(0);
      }
      exit(0);
    }

    # Windows XP
    if(hotfix_check_sp(xp:4) > 0)
    {
      SP = get_kb_item("SMB/WinXP/ServicePack");
      if("Service Pack 2" >< SP)
      {
        # Grep for shell32.dll < 6.0.2900.3402
        if(version_is_less(version:shellVer, test_version:"6.0.2900.3402")){
          security_message(0);
        }
        exit(0);
      }
      else if("Service Pack 3" >< SP)
      {
        # Grep for shell32.dll < 6.0.2900.5622
        if(version_is_less(version:shellVer, test_version:"6.0.2900.5622")){
          security_message(0);
        }
        exit(0);
      }
      security_message(0);
    }

    # Windows 2003
    if(hotfix_check_sp(win2003:3) > 0)
    {
      SP = get_kb_item("SMB/Win2003/ServicePack");
      if("Service Pack 1" >< SP)
      {
        # Grep for shell32.dll version < 6.0.3790.3158
        if(version_is_less(version:shellVer, test_version:"6.0.3790.3158")){
           security_message(0);
        }
        exit(0);
      }
      else if("Service Pack 2" >< SP)
      {
        # Grep for shell32.dll version < 6.0.3790.4315
        if(version_is_less(version:shellVer, test_version:"6.0.3790.4315")){
            security_message(0);
        }
        exit(0);
      }
      security_message(0);
    }
  }
}

## Get System32 path
sysPath = smb_get_system32root();
if(sysPath)
{
  dllVer = fetch_file_version(sysPath, file_name:"shell32.dll");
  if(dllVer)
  {
    # Windows Vista
    if(hotfix_check_sp(winVista:2) > 0)
    {
      SP = get_kb_item("SMB/WinVista/ServicePack");
      if("Service Pack 1" >< SP)
      {
        # Grep for shell32.dll version < 6.0.6001.18062 
        if(version_is_less(version:dllVer, test_version:"6.0.6001.18062")){
          security_message(0);
        }
         exit(0);
      }
    }

    # Windows Server 2008
    else if(hotfix_check_sp(win2008:2) > 0)
    {
      SP = get_kb_item("SMB/Win2008/ServicePack");
      if("Service Pack 1" >< SP)
      {
        # Grep for shell32.dll version < 6.0.6001.18062
        if(version_is_less(version:dllVer, test_version:"6.0.6001.18062")){
          security_message(0);
        }
         exit(0);
      }
    }
  }
}