製品・ソフトウェアに関する情報

JVN脆弱性詳細

Microsoft Internet Explorer の URL 検証における任意のローカルプログラムを実行される脆弱性

Title	Microsoft Internet Explorer の URL 検証における任意のローカルプログラムを実行される脆弱性
Summary	Microsoft Internet Explorer の URL 検証には、入力パラメータを適切に処理しないため、任意のローカルプログラムを実行される脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された URL を介して、任意のローカルプログラムを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 21, 2010, midnight
Registration Date	Feb. 22, 2010, 12:15 p.m.
Last Update	Feb. 22, 2010, 12:15 p.m.

CVSS2.0 : 危険
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected System

マイクロソフト

Microsoft Internet Explorer 5.01

Microsoft Internet Explorer 6

Microsoft Internet Explorer 7

Microsoft Internet Explorer 8

Microsoft Windows 2000

Microsoft Windows 7 (x32)

Microsoft Windows 7 (x64)

Microsoft Windows Server 2003

Microsoft Windows Server 2003 (itanium)

Microsoft Windows Server 2003 (x64)

Microsoft Windows Server 2008 (itanium)

Microsoft Windows Server 2008 (x64)

Microsoft Windows Server 2008 (x86)

Microsoft Windows Server 2008 r2(itanium)

Microsoft Windows Server 2008 r2(x64)

Microsoft Windows Vista

Microsoft Windows Vista (x64)

Microsoft Windows XP (x64)

Microsoft Windows XP sp3

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-0027	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0027
National Vulnerability Database (NVD)
2	CVE-2010-0027	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0027

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-94	https://jvndb.jvn.jp/ja/cwe/CWE-94.html

ベンダー情報

No	Name	URL
Microsoft Security Bulletin
1	MS10-002	http://www.microsoft.com/technet/security/bulletin/MS10-002.mspx
2	MS10-007	http://www.microsoft.com/technet/security/bulletin/MS10-007.mspx
マイクロソフトセキュリティ情報
3	MS10-002	http://www.microsoft.com/japan/technet/security/bulletin/ms10-002.mspx
4	MS10-007	http://www.microsoft.com/japan/technet/security/bulletin/ms10-007.mspx
絵でみるセキュリティ情報
5	MS10-002e	http://www.microsoft.com/japan/security/bulletins/MS10-002e.mspx
6	MS10-007e	http://www.microsoft.com/japan/security/bulletins/MS10-007e.mspx

その他

No	Name	URL
IPA 緊急対策情報
1	20100122-ms10-002	http://www.ipa.go.jp/security/ciadr/vul/20100122-ms10-002.html
ISS X-Force Database
2	55773	http://xforce.iss.net/xforce/xfdb/55773
JPCERT 緊急報告
3	JPCERT-AT-2010-0004	https://www.jpcert.or.jp/at/2010/at100004.txt
4	JPCERT-AT-2010-0006	http://www.jpcert.or.jp/at/2010/at100006.txt
JVN
5	JVNTA10-021A	http://jvn.jp/cert/JVNTA10-021A/
6	JVNTA10-040A	http://jvn.jp/cert/JVNTA10-040A/
JVN Status Tracking Notes
7	JVNTR-2010-04	http://jvn.jp/tr/JVNTR-2010-04/
8	JVNTR-2010-05	http://jvn.jp/tr/JVNTR-2010-05/
9	JVNTR-2010-06	http://jvn.jp/tr/JVNTR-2010-06
Secunia Advisory
10	SA38501	http://secunia.com/advisories/38501/
SecurityFocus
11	37884	http://www.securityfocus.com/bid/37884
US-CERT Cyber Security Alerts
12	SA10-021A	http://www.us-cert.gov/cas/alerts/SA10-021A.html
13	SA10-040A	http://www.us-cert.gov/cas/alerts/SA10-040A.html
US-CERT Technical Cyber Security Alert
14	TA10-021A	http://www.us-cert.gov/cas/techalerts/TA10-021A.html
15	TA10-040A	http://www.us-cert.gov/cas/techalerts/TA10-040A.html
16	TA10-055A	http://www.us-cert.gov/cas/techalerts/TA10-055A.html
VUPEN Security
17	VUPEN/ADV-2010-0187	http://www.vupen.com/english/advisories/2010/0187
18	VUPEN/ADV-2010-0340	http://www.vupen.com/english/advisories/2010/0340
警察庁 @police
19	マイクロソフト社のセキュリティ修正プログラムについて(MS10-002)	http://www.npa.go.jp/cyberpolice/#topics
20	マイクロソフト社のセキュリティ修正プログラムについて(MS10-003,004,005,006,007,008,009,010,011,012,013,014,015)	http://www.npa.go.jp/cyberpolice/#topics

Change Log

No	Changed Details	Date of change
0	[2010年02月22日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2010-0027

Summary	The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, does not properly process input parameters, which allows remote attackers to execute arbitrary local programs via a crafted URL, aka "URL Validation Vulnerability."
Publication Date	Jan. 23, 2010, 7 a.m.
Registration Date	Jan. 29, 2021, 10:55 a.m.
Last Update	Dec. 8, 2023, 3:38 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:8:::::::*
cpe:2.3:a:microsoft:internet_explorer:8.0.6001:::::::*
cpe:2.3:o:microsoft:windows_7:-:::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:itanium:::::
cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:x64:::::
cpe:2.3:o:microsoft:windows_vista::::::::
cpe:2.3:o:microsoft:windows_vista:::x64:::::*
cpe:2.3:o:microsoft:windows_vista::sp1::::::*
cpe:2.3:o:microsoft:windows_vista::sp2::::::*
cpe:2.3:o:microsoft:windows_xp::sp2::::::*
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:7:::::::*
cpe:2.3:a:microsoft:internet_explorer:7.0:::::::*
cpe:2.3:a:microsoft:internet_explorer:7.0.5730:unknown:gold:::::*
cpe:2.3:a:microsoft:internet_explorer:7.0.5730.11:::::::*
cpe:2.3:a:microsoft:internet_explorer:7.00.5730.1100:::::::*
cpe:2.3:a:microsoft:internet_explorer:7.00.6000.16386:::::::*
cpe:2.3:a:microsoft:internet_explorer:7.00.6000.16441:::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
cpe:2.3:o:microsoft:windows_vista:::x64:::::*
cpe:2.3:o:microsoft:windows_vista::sp1::::::*
cpe:2.3:o:microsoft:windows_vista::sp2::::::*
cpe:2.3:o:microsoft:windows_vista::::::::
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_xp::sp2::::::*
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:6:sp1::::::
cpe:2.3:a:microsoft:internet_explorer:5.01:sp4::::::
cpe:2.3:a:microsoft:internet_explorer:6:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:o:microsoft:windows_xp::sp2::::::*
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*
cpe:2.3:o:microsoft:windows_2000::sp4::::::*
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::

Related information, measures and tools

No	URL	refsource	タグ
1	http://www.zerodayinitiative.com/advisories/ZDI-10-016/	MISC
2	http://www.us-cert.gov/cas/techalerts/TA10-040A.html	CERT	US Government Resource
3	https://exchange.xforce.ibmcloud.com/vulnerabilities/55773	XF
4	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8464	OVAL
5	http://www.securityfocus.com/archive/1/509470/100/0/threaded	BUGTRAQ
6	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-007	MS
7	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002	MS

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-94	コード・インジェクション	https://cwe.mitre.org/data/definitions/94.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:8:::::::*
cpe:2.3:a:microsoft:internet_explorer:8.0.6001:::::::*
cpe:2.3:o:microsoft:windows_7:-:::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:itanium:::::
cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:x64:::::
cpe:2.3:o:microsoft:windows_vista::::::::
cpe:2.3:o:microsoft:windows_vista:::x64:::::*
cpe:2.3:o:microsoft:windows_vista::sp1::::::*
cpe:2.3:o:microsoft:windows_vista::sp2::::::*
cpe:2.3:o:microsoft:windows_xp::sp2::::::*
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:7:::::::*
cpe:2.3:a:microsoft:internet_explorer:7.0:::::::*
cpe:2.3:a:microsoft:internet_explorer:7.0.5730:unknown:gold:::::*
cpe:2.3:a:microsoft:internet_explorer:7.0.5730.11:::::::*
cpe:2.3:a:microsoft:internet_explorer:7.00.5730.1100:::::::*
cpe:2.3:a:microsoft:internet_explorer:7.00.6000.16386:::::::*
cpe:2.3:a:microsoft:internet_explorer:7.00.6000.16441:::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
cpe:2.3:o:microsoft:windows_vista:::x64:::::*
cpe:2.3:o:microsoft:windows_vista::sp1::::::*
cpe:2.3:o:microsoft:windows_vista::sp2::::::*
cpe:2.3:o:microsoft:windows_vista::::::::
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_xp::sp2::::::*
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:o:microsoft:windows_xp::sp2::::::*
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*
cpe:2.3:o:microsoft:windows_2000::sp4::::::*
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::