Analysis of vulnerabilities reported by patrik-vetter on Slack

[Tostti]

Description

A community user has reported that version 4.8.0 of the vulnerability detector incorrectly reports some vulnerabilities. This issue aims to investigate these reports, verify the accuracy of the vulnerability detection, and address any discrepancies. The user didn't provide complete information, only mentioned that it is Windows Server 2022.

Transcription:

Package: Microsoft Office Standard 2019 - sv-se 16.0.10411.20011
OS: Windows Server 2022
CVEs: CVE-1999-0794, CVE-2004-0848, CVE-2006-4694, CVE-2007-3109, CVE-2007-3282, CVE-2021-43905

Package: Microsoft Office Professional Plus 2019 - sv-se 16.0.10411.20011
OS: Windows Server 2022
CVEs: CVE-1999-0794 , CVE-2004-0848, CVE-2006-4694, CVE-2007-3109, CVE-2007-3282, CVE-2021-43905

Package: Microsoft Windows Server 2016 Standard 10.1.14393.7070
OS: Windows Server 
CVEs: CVE-2017-0078

Context

Accurate vulnerability detection is critical for maintaining the security and reliability of systems. Incorrectly reported vulnerabilities can lead to unnecessary concerns or, conversely, missed critical security issues. It is essential to thoroughly investigate these reports to ensure the detector's reliability and trustworthiness.

Expected

• Analyze the vulnerabilities reported as incorrect by the user.
• Determine the accuracy of the detection for each reported vulnerability.
• If any detections are found to be incorrect, document the issues and create separate sanitization issues for each affected CVE-ID and vendor.

Steps to Complete

1. Gather Information:

   • Obtain detailed reports from the user, including CVE-IDs, affected versions, and any additional relevant information.

2. Analyze Reports:

   • Review the reported vulnerabilities to understand the context and specifics of the incorrect detections.
   • Cross-reference the detections with official vulnerability databases such as NVD, vendor advisories, and other reputable sources.

3. Document Findings:

   • For each vulnerability analyzed, document the findings, including the CVE-ID, vendor, and nature of the discrepancy.

4. Create Sanitization Issues:

   • Create individual sanitization issues for each CVE-ID and vendor where incorrect detections were found.

Deliverables

• [x] Comprehensive report detailing the analysis of each reported vulnerability.
• [x] Separate sanitization issues created for each incorrect detection, with detailed descriptions and corrective actions.

[matias-braida]

CVE-2017-0078

NVD Content

Installed package

Microsoft Windows Server 2016 Standard version = 10.1.14393.7070

Conclusion

The information provided by NVD is not sufficient to confirm whether the vulnerability has been accurately reported or if a patch version is available. It is necessary to conduct a more thorough search in other sources to gather additional details about the reported issue. This further investigation will enable us to determine the appropriate sanitization measures to apply.

[matias-braida]

CVE-1999-0794

NVD Content

Microsoft Content

Installed package

Microsoft Office Standard 2019 - sv-se version = 16.0.10411.20011 Microsoft Office Professional Plus 2019 - sv-se version = 16.0.10411.20011

Conclusion

The information provided by NVD is not sufficient to confirm whether the vulnerability has been accurately reported or if a patch version is available.

The information provided by Microsoft seems to be that the vulnerability only applies to: Microsoft Excel 97, whether shipped alone or as part of Office 97. Microsoft Excel 2000, whether shipped alone or as part of Office 2000.

It is necessary to conduct a more thorough search in other sources to gather additional details about the reported issue. This further investigation will enable us to determine the appropriate sanitization measures to apply.

[matias-braida]

CVE-2004-0848

NVD Content

Installed package

Microsoft Office Standard 2019 - sv-se version = 16.0.10411.20011 Microsoft Office Professional Plus 2019 - sv-se version = 16.0.10411.20011

Conclusion

The information provided by NVD is not sufficient to confirm whether the vulnerability has been accurately reported or if a patch version is available. It is necessary to conduct a more thorough search in other sources to gather additional details about the reported issue. This further investigation will enable us to determine the appropriate sanitization measures to apply.

[matias-braida]

CVE-2006-4694

NVD Content

Microsoft Content

https://learn.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-058

Installed package

Microsoft Office Standard 2019 - sv-se version = 16.0.10411.20011 Microsoft Office Professional Plus 2019 - sv-se version = 16.0.10411.20011

Conclusion

The information provided by NVD is not sufficient to confirm whether the vulnerability has been accurately reported or if a patch version is available.

The information provided by Microsoft seems to be that the vulnerability only applies to: Microsoft Office 2000 Service Pack 3 Microsoft Office XP Service Pack 3 Microsoft Office 2003 Service Pack 1 or Service Pack 2 Microsoft Office 2004 for Mac Microsoft Office v. X for Mac

It is necessary to conduct a more thorough search in other sources to gather additional details about the reported issue. This further investigation will enable us to determine the appropriate sanitization measures to apply.

[matias-braida]

CVE-2007-3109

NVD Content

Installed package

Microsoft Office Standard 2019 - sv-se version = 16.0.10411.20011 Microsoft Office Professional Plus 2019 - sv-se version = 16.0.10411.20011

Conclusion

The information provided by NVD is not sufficient to confirm whether the vulnerability has been accurately reported or if a patch version is available. It is necessary to conduct a more thorough search in other sources to gather additional details about the reported issue. This further investigation will enable us to determine the appropriate sanitization measures to apply.

[matias-braida]

CVE-2007-3282

NVD Content

Installed package

Microsoft Office Standard 2019 - sv-se version = 16.0.10411.20011 Microsoft Office Professional Plus 2019 - sv-se version = 16.0.10411.20011

Conclusion

The information provided by NVD is not sufficient to confirm whether the vulnerability has been accurately reported or if a patch version is available. It is necessary to conduct a more thorough search in other sources to gather additional details about the reported issue. This further investigation will enable us to determine the appropriate sanitization measures to apply.

[matias-braida]

CVE-2021-43905

NVD Content

Microsoft Content

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-43905

Installed package

Microsoft Office Standard 2019 - sv-se version = 16.0.10411.20011 Microsoft Office Professional Plus 2019 - sv-se version = 16.0.10411.20011

Conclusion

The information provided by NVD and Microsoft suggests that the vulnerability has been correctly detected.

This is a true positive case. No sanitization is needed.

[jftuduri]

I move this issue to blocked. When all sanitizations has been applied, this issue can be closed.

[Damian-Mangold]

Reviewed: awaiting sanitizations.

[Damian-Mangold]

Reviewed: awaiting sanitizations.

[Damian-Mangold]

Reviewed: awaiting sanitizations.

[Damian-Mangold]

Reviewed: awaiting sanitizations.

[Damian-Mangold]

Sanitizations applied, efficacy tests should be added.

[matias-braida]

I moved this issue to blocked. When all sanitizations have been applied, the efficacy tests could be done.

[Damian-Mangold]

Added sanitizations and efficacy test.