製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の Microsoft 製品における任意のコードを実行される脆弱性

Title	複数の Microsoft 製品における任意のコードを実行される脆弱性
Summary	複数の Microsoft 製品は、PowerPoint ドキュメントの TimeColorBehaviorContainer 内にある浮動小数点のレコードを適切に処理しないため、任意のコードを実行される、またはサービス運用妨害 (メモリ破損) 状態となる脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された不正なレコードを含む PowerPoint ドキュメントを介して、任意のコードを実行される、またはサービス運用妨害 (メモリ破損) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 12, 2011, midnight
Registration Date	May 6, 2011, 10:56 a.m.
Last Update	May 6, 2011, 10:56 a.m.

Affected System

マイクロソフト

Microsoft Office 2004 (mac_os)

Microsoft Office 2008 (mac_os)

Microsoft Office 2011 (mac_os)

Microsoft PowerPoint 2007

Microsoft PowerPoint 2010 (32-bit editions)

Microsoft PowerPoint 2010 (64-bit editions)

Microsoft PowerPoint Viewer

Microsoft PowerPoint Viewer 2007

Microsoft PowerPoint Web App

Open XML File Format Converter for Mac

Word/Excel/PowerPoint 2007 ファイル形式用 Microsoft Office 互換機能パック

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0655	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0655
National Vulnerability Database (NVD)
2	CVE-2011-0655	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0655

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Microsoft Security Bulletin
1	MS11-022	http://www.microsoft.com/technet/security/bulletin/MS11-022.mspx
マイクロソフトセキュリティアドバイザリ
2	2501584	http://www.microsoft.com/japan/technet/security/advisory/2501584.mspx
マイクロソフトセキュリティ情報
3	MS11-022	http://www.microsoft.com/japan/technet/security/bulletin/MS11-022.mspx
富士通セキュリティ情報
4	TA11-102A	http://software.fujitsu.com/jp/security/vulnerabilities/ta11-102a.html
絵でみるセキュリティ情報
5	MS11-022e	http://www.microsoft.com/japan/security/bulletins/MS11-022e.mspx

その他

No	Name	URL
JPCERT 緊急報告
1	JPCERT-AT-2011-0008	https://www.jpcert.or.jp/at/2011/at110008.txt
JVN
2	JVNTA11-102A	http://jvn.jp/cert/JVNTA11-102A
Secunia Advisory
3	SA39903	http://secunia.com/advisories/39903
SecurityFocus
4	47252	http://www.securityfocus.com/bid/47252
SecurityTracker
5	1025340	http://www.securitytracker.com/id?1025340
US-CERT Cyber Security Alerts
6	SA11-102A	http://www.us-cert.gov/cas/alerts/SA11-102A.html
US-CERT Technical Cyber Security Alert
7	TA11-102A	http://www.us-cert.gov/cas/techalerts/TA11-102A.html
VUPEN Security
8	VUPEN/ADV-2011-0941	http://www.vupen.com/english/advisories/2011/0941
警察庁 @police
9	マイクロソフト社のセキュリティ修正プログラムについて(MS11-018,019,020,021,022,023,024,025,026,027,028,029,030,031,032,033,034)	http://www.npa.go.jp/cyberpolice/#topics

Change Log

No	Changed Details	Date of change
0	[2011年05月06日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-0655

Summary	Microsoft PowerPoint 2007 SP2 and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; PowerPoint Viewer; PowerPoint Viewer 2007 SP2; and PowerPoint Web App do not properly validate TimeColorBehaviorContainer Floating Point records in PowerPoint documents, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document containing an invalid record, aka "Floating Point Techno-color Time Bandit RCE Vulnerability."
Publication Date	April 14, 2011, 3:55 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:24 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:microsoft:open_xml_file_format_converter:::mac:::::*
cpe:2.3:a:microsoft:office:2008::mac:::::
cpe:2.3:a:microsoft:powerpoint:2010::x32:::::
cpe:2.3:a:microsoft:office:2004::mac:::::
cpe:2.3:a:microsoft:powerpoint_web_app::::::::
cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2::::::
cpe:2.3:a:microsoft:powerpoint_viewer:2007:sp2::::::
cpe:2.3:a:microsoft:office_powerpoint_viewer::::::::
cpe:2.3:a:microsoft:powerpoint:2010::x64:::::
cpe:2.3:a:microsoft:office:2011::mac:::::

Related information, measures and tools

No	URL	タグ
1	http://www.securitytracker.com/id?1025340
2	http://www.us-cert.gov/cas/techalerts/TA11-102A.html	US Government Resource
3	http://www.vupen.com/english/advisories/2011/0941	Vendor Advisory
4	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-022
5	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12624
6	http://www.securitytracker.com/id?1025340
7	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12624
8	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-022
9	http://www.vupen.com/english/advisories/2011/0941	Vendor Advisory
10	http://www.us-cert.gov/cas/techalerts/TA11-102A.html	US Government Resource

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:microsoft:open_xml_file_format_converter:::mac:::::*
cpe:2.3:a:microsoft:office:2008::mac:::::
cpe:2.3:a:microsoft:powerpoint:2010::x32:::::
cpe:2.3:a:microsoft:office:2004::mac:::::
cpe:2.3:a:microsoft:powerpoint_web_app::::::::
cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2::::::
cpe:2.3:a:microsoft:powerpoint_viewer:2007:sp2::::::
cpe:2.3:a:microsoft:office_powerpoint_viewer::::::::
cpe:2.3:a:microsoft:powerpoint:2010::x64:::::
cpe:2.3:a:microsoft:office:2011::mac:::::