製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の Microsoft 製品における任意のコードを実行される脆弱性

Title	複数の Microsoft 製品における任意のコードを実行される脆弱性
Summary	複数の Microsoft 製品は、PowerPoint ドキュメントの PersistDirectoryEntry レコードを適切に処理しないため、任意のコードを実行される、またはサービス運用妨害 (メモリ破損) 状態となる脆弱性が存在します。
Possible impacts	第三者により、不正な形式のレコードを付与された PowerPoint スライドを介して、任意のコードを実行される、またはサービス運用妨害 (メモリ破損) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 12, 2011, midnight
Registration Date	May 6, 2011, 10:57 a.m.
Last Update	May 6, 2011, 10:57 a.m.

Affected System

マイクロソフト

Microsoft Office 2004 (mac_os)

Microsoft Office 2008 (mac_os)

Microsoft Office 2011 (mac_os)

Microsoft PowerPoint 2002

Microsoft PowerPoint 2003

Microsoft PowerPoint 2007

Microsoft PowerPoint 2010 (32-bit editions)

Microsoft PowerPoint 2010 (64-bit editions)

Microsoft PowerPoint Viewer

Microsoft PowerPoint Viewer 2007

Microsoft PowerPoint Web App

Open XML File Format Converter for Mac

Word/Excel/PowerPoint 2007 ファイル形式用 Microsoft Office 互換機能パック

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0656	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0656
National Vulnerability Database (NVD)
2	CVE-2011-0656	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0656

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Microsoft Security Bulletin
1	MS11-022	http://www.microsoft.com/technet/security/bulletin/MS11-022.mspx
マイクロソフトセキュリティアドバイザリ
2	2501584	http://www.microsoft.com/japan/technet/security/advisory/2501584.mspx
マイクロソフトセキュリティ情報
3	MS11-022	http://www.microsoft.com/japan/technet/security/bulletin/MS11-022.mspx
富士通セキュリティ情報
4	TA11-102A	http://software.fujitsu.com/jp/security/vulnerabilities/ta11-102a.html
絵でみるセキュリティ情報
5	MS11-022e	http://www.microsoft.com/japan/security/bulletins/MS11-022e.mspx

その他

No	Name	URL
JPCERT 緊急報告
1	JPCERT-AT-2011-0008	https://www.jpcert.or.jp/at/2011/at110008.txt
JVN
2	JVNTA11-102A	http://jvn.jp/cert/JVNTA11-102A
OPEN SOURCE VULNERABILITY DATABASE (OSVDB)
3	71770	http://osvdb.org/71770
Secunia Advisory
4	SA39903	http://secunia.com/advisories/39903
SecurityFocus
5	47251	http://www.securityfocus.com/bid/47251
SecurityTracker
6	1025340	http://www.securitytracker.com/id?1025340
US-CERT Cyber Security Alerts
7	SA11-102A	http://www.us-cert.gov/cas/alerts/SA11-102A.html
US-CERT Technical Cyber Security Alert
8	TA11-102A	http://www.us-cert.gov/cas/techalerts/TA11-102A.html
VUPEN Security
9	VUPEN/ADV-2011-0941	http://www.vupen.com/english/advisories/2011/0941
警察庁 @police
10	マイクロソフト社のセキュリティ修正プログラムについて(MS11-018,019,020,021,022,023,024,025,026,027,028,029,030,031,032,033,034)	http://www.npa.go.jp/cyberpolice/#topics

Change Log

No	Changed Details	Date of change
0	[2011年05月06日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-0656

Summary	Microsoft PowerPoint 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; PowerPoint Viewer; PowerPoint Viewer 2007 SP2; and PowerPoint Web App do not properly validate PersistDirectoryEntry records in PowerPoint documents, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Slide with a malformed record, which triggers an exception and later use of an unspecified method, aka "Persist Directory RCE Vulnerability."
Publication Date	April 14, 2011, 3:55 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:24 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:microsoft:open_xml_file_format_converter:::mac:::::*
cpe:2.3:a:microsoft:office:2008::mac:::::
cpe:2.3:a:microsoft:powerpoint:2010:::::::*
cpe:2.3:a:microsoft:office:2004::mac:::::
cpe:2.3:a:microsoft:powerpoint:2003:sp3::::::
cpe:2.3:a:microsoft:powerpoint_web_app::::::::
cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2::::::
cpe:2.3:a:microsoft:powerpoint:2007:sp2::::::
cpe:2.3:a:microsoft:powerpoint:2002:sp3::::::
cpe:2.3:a:microsoft:powerpoint_viewer:2007:sp2::::::
cpe:2.3:a:microsoft:office_powerpoint_viewer::::::::
cpe:2.3:a:microsoft:office:2011::mac:::::

Related information, measures and tools

No	URL	タグ
1	http://osvdb.org/71770
2	http://www.securityfocus.com/archive/1/517482/100/0/threaded
3	http://www.securityfocus.com/bid/47251
4	http://www.securitytracker.com/id?1025340
5	http://www.us-cert.gov/cas/techalerts/TA11-102A.html	US Government Resource
6	http://www.vupen.com/english/advisories/2011/0941	Vendor Advisory
7	http://www.zerodayinitiative.com/advisories/ZDI-11-125
8	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-022
9	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11761
10	http://osvdb.org/71770
11	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11761
12	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-022
13	http://www.zerodayinitiative.com/advisories/ZDI-11-125
14	http://www.vupen.com/english/advisories/2011/0941	Vendor Advisory
15	http://www.us-cert.gov/cas/techalerts/TA11-102A.html	US Government Resource
16	http://www.securitytracker.com/id?1025340
17	http://www.securityfocus.com/bid/47251
18	http://www.securityfocus.com/archive/1/517482/100/0/threaded

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:microsoft:open_xml_file_format_converter:::mac:::::*
cpe:2.3:a:microsoft:office:2008::mac:::::
cpe:2.3:a:microsoft:powerpoint:2010:::::::*
cpe:2.3:a:microsoft:office:2004::mac:::::
cpe:2.3:a:microsoft:powerpoint:2003:sp3::::::
cpe:2.3:a:microsoft:powerpoint_web_app::::::::
cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2::::::
cpe:2.3:a:microsoft:powerpoint:2007:sp2::::::
cpe:2.3:a:microsoft:powerpoint:2002:sp3::::::
cpe:2.3:a:microsoft:powerpoint_viewer:2007:sp2::::::
cpe:2.3:a:microsoft:office_powerpoint_viewer::::::::
cpe:2.3:a:microsoft:office:2011::mac:::::