製品・ソフトウェアに関する情報

JVN脆弱性詳細

Microsoft Internet Explorer における任意のコードを実行される脆弱性

Title	Microsoft Internet Explorer における任意のコードを実行される脆弱性
Summary	Microsoft Internet Explorer には、メモリ内のオブジェクトを適切に処理しないため、任意のコードを実行される脆弱性が存在します。
Possible impacts	第三者により、適切に初期化されなかった、または削除されるオブジェクへのアクセスを介して、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 10, 2011, midnight
Registration Date	May 2, 2011, 2:01 p.m.
Last Update	May 2, 2011, 2:01 p.m.

CVSS2.0 : 危険
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected System

マイクロソフト

Microsoft Internet Explorer 6

Microsoft Internet Explorer 7

Microsoft Internet Explorer 8

Microsoft Windows 7 (x32)

Microsoft Windows 7 (x64)

Microsoft Windows Server 2003

Microsoft Windows Server 2003 (itanium)

Microsoft Windows Server 2003 (x64)

Microsoft Windows Server 2008 (itanium)

Microsoft Windows Server 2008 (x64)

Microsoft Windows Server 2008 (x86)

Microsoft Windows Server 2008 r2(itanium)

Microsoft Windows Server 2008 r2(x64)

Microsoft Windows Vista

Microsoft Windows Vista (x64)

Microsoft Windows XP (x64)

Microsoft Windows XP sp3

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-1345	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1345
National Vulnerability Database (NVD)
2	CVE-2011-1345	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1345

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Microsoft Security Bulletin
1	MS11-018	http://www.microsoft.com/technet/security/bulletin/MS11-018.mspx
マイクロソフトセキュリティ情報
2	MS11-018	http://www.microsoft.com/japan/technet/security/bulletin/MS11-018.mspx
富士通セキュリティ情報
3	TA11-102A	http://software.fujitsu.com/jp/security/vulnerabilities/ta11-102a.html
絵でみるセキュリティ情報
4	MS11-018e	http://www.microsoft.com/japan/security/bulletins/MS11-018e.mspx

その他

No	Name	URL
IPA 緊急対策情報
1	20110413-ms11-018	http://www.ipa.go.jp/security/ciadr/vul/20110413-ms11-018.html
ISS X-Force Database
2	66062	http://xforce.iss.net/xforce/xfdb/66062
JPCERT 緊急報告
3	JPCERT-AT-2011-0008	https://www.jpcert.or.jp/at/2011/at110008.txt
JVN
4	JVNTA11-102A	http://jvn.jp/cert/JVNTA11-102A
Secunia Advisory
5	SA44153	http://secunia.com/advisories/44153
SecurityFocus
6	46821	http://www.securityfocus.com/bid/46821
US-CERT Cyber Security Alerts
7	SA11-102A	http://www.us-cert.gov/cas/alerts/SA11-102A.html
US-CERT Technical Cyber Security Alert
8	TA11-102A	http://www.us-cert.gov/cas/techalerts/TA11-102A.html
VUPEN Security
9	VUPEN/ADV-2011-0937	http://www.vupen.com/english/advisories/2011/0937
警察庁 @police
10	マイクロソフト社のセキュリティ修正プログラムについて(MS11-018,019,020,021,022,023,024,025,026,027,028,029,030,031,032,033,034)	http://www.npa.go.jp/cyberpolice/#topics

Change Log

No	Changed Details	Date of change
0	[2011年05月02日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-1345

Summary	Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, as demonstrated by Stephen Fewer as the first of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011, aka "Object Management Memory Corruption Vulnerability."
Publication Date	March 11, 2011, 5:55 a.m.
Registration Date	Jan. 28, 2021, 4:38 p.m.
Last Update	Nov. 21, 2024, 10:26 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:microsoft:internet_explorer:8:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_7::::::::

Related information, measures and tools

No	URL	タグ
1	http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
2	http://twitter.com/aaronportnoy/statuses/45642180118855680
3	http://twitter.com/msftsecresponse/statuses/45646985998516224
4	http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own
5	http://www.securityfocus.com/bid/46821
6	http://www.securitytracker.com/id?1025327
7	http://www.us-cert.gov/cas/techalerts/TA11-102A.html	US Government Resource
8	http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367
9	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/66062
11	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12228
12	https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011
13	http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
14	https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011
15	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12228
16	https://exchange.xforce.ibmcloud.com/vulnerabilities/66062
17	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018
18	http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367
19	http://www.us-cert.gov/cas/techalerts/TA11-102A.html	US Government Resource
20	http://www.securitytracker.com/id?1025327
21	http://www.securityfocus.com/bid/46821
22	http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own
23	http://twitter.com/msftsecresponse/statuses/45646985998516224
24	http://twitter.com/aaronportnoy/statuses/45642180118855680

Common Vulnerabilities List