製品・ソフトウェアに関する情報

JVN脆弱性詳細

Microsoft Internet Explorer 8 における解放済みメモリを使用する脆弱性

Title	Microsoft Internet Explorer 8 における解放済みメモリを使用する脆弱性
Summary	Microsoft Internet Explorer 8 の mshtml.dll ライブラリには、解放済みメモリを使用する (use-after-free) 脆弱性が存在します。
Possible impacts	ユーザのウェブブラウザがクラッシュしたり、ユーザの権限で任意のコードを実行されたりする可能性があります。
Solution	[アップデートする] 2011年4月13日にセキュリティ更新プログラムが公開されました。マイクロソフトが提供する情報 (MS11-018) をもとにアップデートしてください。 [ワークアラウンドを実施する] 対策版が公開されるまでの間、以下の回避策を適用することで、本脆弱性の影響を軽減することが可能です。 * Enhanced Mitigation Experience Toolkit (EMET) を利用する
Publication Date	Jan. 7, 2011, midnight
Registration Date	Jan. 28, 2011, 3:38 p.m.
Last Update	May 2, 2011, 1:25 p.m.

CVSS2.0 : 危険
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected System

マイクロソフト

Microsoft Internet Explorer 8

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0346	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0346
National Vulnerability Database (NVD)
2	CVE-2011-0346	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0346

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-399	https://jvndb.jvn.jp/ja/cwe/CWE-399.html

ベンダー情報

No	Name	URL
Microsoft Security Bulletin
1	MS11-018	http://www.microsoft.com/technet/security/bulletin/MS11-018.mspx
Security Research and Defense Blog
2	Assessing the risk of public issues currently being tracked by the MSRC	http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspx
マイクロソフトセキュリティ情報
3	MS11-018	http://www.microsoft.com/japan/technet/security/bulletin/MS11-018.mspx
富士通セキュリティ情報
4	TA11-102A	http://software.fujitsu.com/jp/security/vulnerabilities/ta11-102a.html
絵でみるセキュリティ情報
5	MS11-018e	http://www.microsoft.com/japan/security/bulletins/MS11-018e.mspx

その他

No	Name	URL
IPA 緊急対策情報
1	20110413-ms11-018	http://www.ipa.go.jp/security/ciadr/vul/20110413-ms11-018.html
JPCERT 緊急報告
2	JPCERT-AT-2011-0008	https://www.jpcert.or.jp/at/2011/at110008.txt
JVN
3	JVNTA11-102A	http://jvn.jp/cert/JVNTA11-102A
4	JVNVU#427980	http://jvn.jp/cert/JVNVU427980
SecurityFocus
5	45639	http://www.securityfocus.com/bid/45639
US-CERT Cyber Security Alerts
6	SA11-102A	http://www.us-cert.gov/cas/alerts/SA11-102A.html
US-CERT Technical Cyber Security Alert
7	TA11-102A	http://www.us-cert.gov/cas/techalerts/TA11-102A.html
US-CERT Vulnerability Note
8	VU#427980	http://www.kb.cert.org/vuls/id/427980
VUPEN Security
9	VUPEN/ADV-2011-0026	http://www.vupen.com/english/advisories/2011/0026
警察庁 @police
10	マイクロソフト社のセキュリティ修正プログラムについて(MS11-018,019,020,021,022,023,024,025,026,027,028,029,030,031,032,033,034)	http://www.npa.go.jp/cyberpolice/#topics

Change Log

No	Changed Details	Date of change
0	[2011年01月28日] 掲載 [2011年05月02日] ベンダ情報：マイクロソフト (MS11-018) を追加ベンダ情報：マイクロソフト (Assessing the risk of public issues currently being tracked by the MSRC) を追加対策：対策方法の記述を更新しました CVSS による深刻度の内容を更新しました	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-0346

Summary	Use-after-free vulnerability in the ReleaseInterface function in MSHTML.DLL in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the DOM implementation and the BreakAASpecial and BreakCircularMemoryReferences functions, as demonstrated by cross_fuzz, aka "MSHTML Memory Corruption Vulnerability."
Publication Date	Jan. 8, 2011, 8 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:23 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:6:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
3	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
4	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
5	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:7:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
3	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
4	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
5	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
6	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
7	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
8	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
9	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
10	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
11	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
12	cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
13	cpe:2.3:o:microsoft:windows_vista:-:sp1::::::
14	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
15	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:8:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
2	cpe:2.3:o:microsoft:windows_7::::::::
3	cpe:2.3:o:microsoft:windows_7:-:::::::*
4	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
5	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
6	cpe:2.3:o:microsoft:windows_server_2008::r2:itanium:::::
7	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
9	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
10	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
11	cpe:2.3:o:microsoft:windows_server_2008::r2:x64:::::
12	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
13	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
14	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
15	cpe:2.3:o:microsoft:windows_vista:-:sp1::::::
16	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
17	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Related information, measures and tools

No	URL	タグ
1	http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0698.html
2	http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspx
3	http://lcamtuf.blogspot.com/2011/01/announcing-crossfuzz-potential-0-day-in.html
4	http://lcamtuf.coredump.cx/cross_fuzz/fuzzer_timeline.txt
5	http://lcamtuf.coredump.cx/cross_fuzz/known_vuln.txt
6	http://lcamtuf.coredump.cx/cross_fuzz/msie_crash.txt
7	http://www.kb.cert.org/vuls/id/427980	US Government Resource
8	http://www.securityfocus.com/archive/1/515506/100/0/threaded
9	http://www.securityfocus.com/bid/45639
10	http://www.securitytracker.com/id?1024940
11	http://www.us-cert.gov/cas/techalerts/TA11-102A.html	US Government Resource
12	http://www.vupen.com/english/advisories/2011/0026	Vendor Advisory
13	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/64482
15	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11882
16	http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0698.html
17	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11882
18	https://exchange.xforce.ibmcloud.com/vulnerabilities/64482
19	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018
20	http://www.vupen.com/english/advisories/2011/0026	Vendor Advisory
21	http://www.us-cert.gov/cas/techalerts/TA11-102A.html	US Government Resource
22	http://www.securitytracker.com/id?1024940
23	http://www.securityfocus.com/bid/45639
24	http://www.securityfocus.com/archive/1/515506/100/0/threaded
25	http://www.kb.cert.org/vuls/id/427980	US Government Resource
26	http://lcamtuf.coredump.cx/cross_fuzz/msie_crash.txt
27	http://lcamtuf.coredump.cx/cross_fuzz/known_vuln.txt
28	http://lcamtuf.coredump.cx/cross_fuzz/fuzzer_timeline.txt
29	http://lcamtuf.blogspot.com/2011/01/announcing-crossfuzz-potential-0-day-in.html
30	http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspx

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-399	リソース管理の問題	https://cwe.mitre.org/data/definitions/399.html

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:7:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
3	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
4	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
5	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
6	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
7	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
8	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
9	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
10	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
11	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
12	cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
13	cpe:2.3:o:microsoft:windows_vista:-:sp1::::::
14	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
15	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:8:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2:itanium:::::
2	cpe:2.3:o:microsoft:windows_7::::::::
3	cpe:2.3:o:microsoft:windows_7:-:::::::*
4	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
5	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
6	cpe:2.3:o:microsoft:windows_server_2008::r2:itanium:::::
7	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
9	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
10	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
11	cpe:2.3:o:microsoft:windows_server_2008::r2:x64:::::
12	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
13	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
14	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
15	cpe:2.3:o:microsoft:windows_vista:-:sp1::::::
16	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
17	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*