製品・ソフトウェアに関する情報

JVN脆弱性詳細

Microsoft Internet Explorer 11 および Microsoft Edge におけるなりすましの脆弱性

Title	Microsoft Internet Explorer 11 および Microsoft Edge におけるなりすましの脆弱性
Summary	Microsoft Internet Explorer 11 および Microsoft Edge には、HTTP コンテンツの解析方法に、なりすましの脆弱性が存在します。ベンダは、本脆弱性を「Microsoft ブラウザーのなりすましの脆弱性」として公開しています。
Possible impacts	コンテンツを偽装される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 11, 2017, midnight
Registration Date	July 18, 2017, 5:57 p.m.
Last Update	July 18, 2017, 5:57 p.m.

Affected System

マイクロソフト

Microsoft Edge

Microsoft Internet Explorer 11

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-8602	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8602
National Vulnerability Database (NVD)
2	CVE-2017-8602	https://nvd.nist.gov/vuln/detail/CVE-2017-8602
Security TechCenter
3	CVE-2017-8602 \| Microsoft Browser Spoofing Vulnerability	https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8602
セキュリティテックセンター
4	CVE-2017-8602 \| Microsoft ブラウザーのなりすましの脆弱性	https://portal.msrc.microsoft.com/ja-jp/security-guidance/advisory/CVE-2017-8602

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

その他

No	Name	URL
IPA 重要なセキュリティ情報
1	Microsoft 製品の脆弱性対策について(2017年7月)	https://www.ipa.go.jp/security/ciadr/vul/20170712-ms.html
JPCERT 注意喚起
2	JPCERT-AT-2017-0027	http://www.jpcert.or.jp/at/2017/at170027.html

Change Log

No	Changed Details	Date of change
0	[2017年07月18日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-8602

Summary	Microsoft browsers on Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a spoofing vulnerability in the way they parse HTTP content, aka "Microsoft Browser Spoofing Vulnerability."
Publication Date	July 12, 2017, 6:29 a.m.
Registration Date	Jan. 26, 2021, 1:30 p.m.
Last Update	Nov. 21, 2024, 12:34 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:microsoft:edge::::::::
cpe:2.3:a:microsoft:internet_explorer:11:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_10:-:::::::*
2	cpe:2.3:o:microsoft:windows_10:1511:::::::*
3	cpe:2.3:o:microsoft:windows_10:1607:::::::*
4	cpe:2.3:o:microsoft:windows_10:1703:::::::*
5	cpe:2.3:o:microsoft:windows_7::sp1::::::*
6	cpe:2.3:o:microsoft:windows_8.1::::::::
7	cpe:2.3:o:microsoft:windows_rt_8.1::::::::
8	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1::::::
9	cpe:2.3:o:microsoft:windows_server_2016::::::::

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/99390	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/99390	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1038859	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1038859	Third Party Advisory VDB Entry
5	http://www.securitytracker.com/id/1038860	Third Party Advisory VDB Entry
6	http://www.securitytracker.com/id/1038860	Third Party Advisory VDB Entry
7	https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8602	Patch Vendor Advisory
8	https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8602	Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:microsoft:edge::::::::
cpe:2.3:a:microsoft:internet_explorer:11:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_10:-:::::::*
2	cpe:2.3:o:microsoft:windows_10:1511:::::::*
3	cpe:2.3:o:microsoft:windows_10:1607:::::::*
4	cpe:2.3:o:microsoft:windows_10:1703:::::::*
5	cpe:2.3:o:microsoft:windows_7::sp1::::::*
6	cpe:2.3:o:microsoft:windows_8.1::::::::
7	cpe:2.3:o:microsoft:windows_rt_8.1::::::::
8	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1::::::
9	cpe:2.3:o:microsoft:windows_server_2016::::::::