| Title | Microsoft Windows の Authenticode Signature Verification における任意のコードを実行される脆弱性 |
|---|---|
| Summary | Microsoft Windows の Authenticode Signature Verification の WinVerifyTrust 関数には、ファイルのダイジェストにおける特定のフィールドの処理に不備があるため、任意のコードを実行される脆弱性が存在します。 |
| Possible impacts | 第三者により、有効なシグネチャを持っているように見える不当な Portable Executable、および cabinet ファイルの変更を介して、任意のコードを実行される可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | April 13, 2010, midnight |
| Registration Date | May 10, 2010, 7:09 p.m. |
| Last Update | May 10, 2010, 7:09 p.m. |
| CVSS2.0 : 危険 | |
| Score | 9.3 |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| マイクロソフト |
| Microsoft Windows 2000 |
| Microsoft Windows 7 (x32) |
| Microsoft Windows 7 (x64) |
| Microsoft Windows Server 2003 |
| Microsoft Windows Server 2003 (itanium) |
| Microsoft Windows Server 2003 (x64) |
| Microsoft Windows Server 2008 (itanium) |
| Microsoft Windows Server 2008 (x64) |
| Microsoft Windows Server 2008 (x86) |
| Microsoft Windows Server 2008 r2(itanium) |
| Microsoft Windows Server 2008 r2(x64) |
| Microsoft Windows Vista |
| Microsoft Windows Vista (x64) |
| Microsoft Windows XP |
| Microsoft Windows XP sp3 |
| No | Changed Details | Date of change |
|---|---|---|
| 0 | [2010年05月10日] 掲載 |
Feb. 17, 2018, 10:37 a.m. |
| Summary | The WinVerifyTrust function in Authenticode Signature Verification 5.1, 6.0, and 6.1 in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly use unspecified fields in a file digest, which allows user-assisted remote attackers to execute arbitrary code via a modified (1) Portable Executable (PE) or (2) cabinet (aka .CAB) file that incorrectly appears to have a valid signature, aka "WinVerifyTrust Signature Validation Vulnerability." |
|---|---|
| Publication Date | April 15, 2010, 1 a.m. |
| Registration Date | Jan. 29, 2021, 10:57 a.m. |
| Last Update | Dec. 8, 2023, 3:38 a.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:* | |||||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:* | |||||
| Configuration3 | or higher | or less | more than | less than | |
| cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:* | |||||
| Configuration4 | or higher | or less | more than | less than | |
| cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:* | |||||
| Configuration5 | or higher | or less | more than | less than | |
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x64:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x86:*:*:*:*:* | |||||
| Configuration6 | or higher | or less | more than | less than | |
| cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:* | |||||
| Configuration7 | or higher | or less | more than | less than | |
| cpe:2.3:o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:* | |||||
| cpe:2.3:o:microsoft:windows_server_2008:*:r2:itanium:*:*:*:*:* | |||||