製品・ソフトウェアに関する情報

JVN脆弱性詳細

Microsoft .NET Framework および Silverlight における任意のコードを実行される脆弱性

Title	Microsoft .NET Framework および Silverlight における任意のコードを実行される脆弱性
Summary	Microsoft .NET Framework および Silverlight は、ネットワーク API 内の関数に対する引数を適切に検証しないため、任意のコードを実行される脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された XAML browser application (XBAP)、ASP.NET アプリケーション、.NET Framework アプリケーション、または Silverlight アプリケーションを介して、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 14, 2011, midnight
Registration Date	June 23, 2011, 11:29 a.m.
Last Update	June 23, 2011, 11:29 a.m.

CVSS2.0 : 危険
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected System

マイクロソフト

Microsoft .NET Framework 2.0

Microsoft .NET Framework 3.5

Microsoft .NET Framework 3.5.1

Microsoft .NET Framework 4.0

Microsoft Silverlight 4

Microsoft Windows 7 (x32)

Microsoft Windows 7 (x64)

Microsoft Windows Server 2003

Microsoft Windows Server 2003 (itanium)

Microsoft Windows Server 2003 (x64)

Microsoft Windows Server 2008 (itanium)

Microsoft Windows Server 2008 (x64)

Microsoft Windows Server 2008 (x86)

Microsoft Windows Server 2008 r2(itanium)

Microsoft Windows Server 2008 r2(x64)

Microsoft Windows Vista

Microsoft Windows Vista (x64)

Microsoft Windows XP (x64)

Microsoft Windows XP sp3

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0664	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0664
National Vulnerability Database (NVD)
2	CVE-2011-0664	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0664

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Microsoft Security Bulletin
1	MS11-039	http://www.microsoft.com/technet/security/bulletin/MS11-039.mspx
マイクロソフトセキュリティ情報
2	MS11-039	http://www.microsoft.com/japan/technet/security/bulletin/MS11-039.mspx
富士通セキュリティ情報
3	TA11-165A	http://software.fujitsu.com/jp/security/vulnerabilities/ta11-165a.html
絵でみるセキュリティ情報
4	MS11-039e	http://www.microsoft.com/japan/security/bulletins/MS11-039e.mspx

その他

No	Name	URL
JPCERT 緊急報告
1	JPCERT-AT-2011-0016	https://www.jpcert.or.jp/at/2011/at110016.txt
JVN
2	JVNTA11-165A	http://jvn.jp/cert/JVNTA11-165A
Secunia Advisory
3	SA44841	http://secunia.com/advisories/44841
SecurityFocus
4	48212	http://www.securityfocus.com/bid/48212
SecurityTracker
5	1025635	http://www.securitytracker.com/id/1025635
6	1025636	http://www.securitytracker.com/id/1025636
US-CERT Cyber Security Alerts
7	SA11-165A	http://www.us-cert.gov/cas/alerts/SA11-165A.html
US-CERT Technical Cyber Security Alert
8	TA11-165A	http://www.us-cert.gov/cas/techalerts/TA11-165A.html
警察庁 @police
9	マイクロソフト社のセキュリティ修正プログラムについて(MS11-037,038,039,040,041,042,043,044,045,046,047,048,049,050,051,052)(2011年06月15日)	http://www.npa.go.jp/cyberpolice/#topics

Change Log

No	Changed Details	Date of change
0	[2011年06月23日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-0664

Summary	Microsoft .NET Framework 2.0 SP1 and SP2, 3.5 Gold and SP1, 3.5.1, and 4.0, and Silverlight 4 before 4.0.60531.0, does not properly validate arguments to unspecified networking API functions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Array Offset Vulnerability."
Publication Date	June 17, 2011, 5:55 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:24 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:microsoft:.net_framework:4.0:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_7:-:sp1:x86:::::*
3	cpe:2.3:o:microsoft:windows_7:-:::::::*
4	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
5	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
6	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
7	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
9	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
10	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
11	cpe:2.3:o:microsoft:windows_server_2008:r2::itanium:::::
12	cpe:2.3:o:microsoft:windows_server_2008:r2::x64:::::
13	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
14	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
15	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
16	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:microsoft:.net_framework:3.5.1:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_7:-:::::::*
2	cpe:2.3:o:microsoft:windows_server_2008:r2::itanium:::::
3	cpe:2.3:o:microsoft:windows_server_2008:r2::x64:::::

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:microsoft:.net_framework:2.0:sp2::::::
execution environment
1	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
2	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
3	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
4	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
5	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
6	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
7	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
8	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
9	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
10	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
11	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:microsoft:.net_framework:3.5:sp1::::::
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
3	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
4	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
5	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
6	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
7	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
9	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
10	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
11	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
12	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration5		or higher	or less	more than	less than
cpe:2.3:a:microsoft:.net_framework:2.0:sp1::::::
execution environment
1	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
2	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
3	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
4	cpe:2.3:o:microsoft:windows_vista::sp1::::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:a:microsoft:.net_framework:3.5:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
3	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
4	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
5	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
6	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
7	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
8	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
9	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration7		or higher	or less	more than	less than
cpe:2.3:a:microsoft:silverlight:4.0.60310.0:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-039
2	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12105
3	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-039
4	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12105

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:microsoft:.net_framework:4.0:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_7:-:sp1:x86:::::*
3	cpe:2.3:o:microsoft:windows_7:-:::::::*
4	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
5	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
6	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
7	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
9	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
10	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
11	cpe:2.3:o:microsoft:windows_server_2008:r2::itanium:::::
12	cpe:2.3:o:microsoft:windows_server_2008:r2::x64:::::
13	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
14	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
15	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
16	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:microsoft:.net_framework:2.0:sp2::::::
execution environment
1	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
2	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
3	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
4	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
5	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
6	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
7	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
8	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
9	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
10	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
11	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:microsoft:.net_framework:3.5:sp1::::::
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
3	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
4	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
5	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
6	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
7	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
9	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
10	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
11	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
12	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:a:microsoft:.net_framework:3.5:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
3	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
4	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
5	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
6	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
7	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
8	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
9	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*