NVD Vulnerability Detail

CVE-2011-0663

Summary	Multiple integer overflows in the Microsoft (1) JScript 5.6 through 5.8 and (2) VBScript 5.6 through 5.8 scripting engines allow remote attackers to execute arbitrary code via a crafted web page, aka "Scripting Memory Reallocation Vulnerability."
Publication Date	April 14, 2011, 3:55 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:24 a.m.

CVSS2.0 : HIGH
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:microsoft:jscript:5.6:::::::*
cpe:2.3:a:microsoft:vbscript:5.6:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
3	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:microsoft:jscript:5.7:::::::*
cpe:2.3:a:microsoft:vbscript:5.7:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
3	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
4	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
5	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
6	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
7	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
9	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
10	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
11	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
12	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:microsoft:jscript:5.8:::::::*
cpe:2.3:a:microsoft:vbscript:5.8:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_7:-:sp1:x64:::::*
3	cpe:2.3:o:microsoft:windows_7:-:sp1:x86:::::*
4	cpe:2.3:o:microsoft:windows_7:-:::::::*
5	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
6	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
7	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
9	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
10	cpe:2.3:o:microsoft:windows_server_2008:r2::itanium:::::
11	cpe:2.3:o:microsoft:windows_server_2008:r2::x64:::::
12	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
13	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
14	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
15	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Related information, measures and tools

No	URL	タグ
1	http://osvdb.org/71774
2	http://secunia.com/advisories/44162
3	http://www.securityfocus.com/bid/47249
4	http://www.securitytracker.com/id?1025333
5	http://www.us-cert.gov/cas/techalerts/TA11-102A.html	US Government Resource
6	http://www.vupen.com/english/advisories/2011/0949
7	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-031
8	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12673
9	http://osvdb.org/71774
10	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12673
11	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-031
12	http://www.vupen.com/english/advisories/2011/0949
13	http://www.us-cert.gov/cas/techalerts/TA11-102A.html	US Government Resource
14	http://www.securitytracker.com/id?1025333
15	http://www.securityfocus.com/bid/47249
16	http://secunia.com/advisories/44162

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-189	数値処理の問題	https://cwe.mitre.org/data/definitions/189.html

JVN Vulnerability Information

Microsoft の JScript および VBScript スクリプトエンジンにおける整数オーバーフローの脆弱性

Title	Microsoft の JScript および VBScript スクリプトエンジンにおける整数オーバーフローの脆弱性
Summary	Microsoft の JScript および VBScript スクリプトエンジンには、任意のコードを実行される脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された Web ページを介して、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 12, 2011, midnight
Registration Date	May 2, 2011, 2:13 p.m.
Last Update	May 2, 2011, 2:13 p.m.

Affected System

マイクロソフト

JScript 5.6 スクリプトエンジン

JScript 5.7 スクリプトエンジン

JScript 5.8 スクリプトエンジン

Microsoft Windows 7 (x32)

Microsoft Windows 7 (x64)

Microsoft Windows Server 2003

Microsoft Windows Server 2003 (itanium)

Microsoft Windows Server 2003 (x64)

Microsoft Windows Server 2008 (itanium)

Microsoft Windows Server 2008 (x64)

Microsoft Windows Server 2008 (x86)

Microsoft Windows Server 2008 r2(itanium)

Microsoft Windows Server 2008 r2(x64)

Microsoft Windows Vista

Microsoft Windows Vista (x64)

Microsoft Windows XP (x64)

Microsoft Windows XP sp3

VBScript 5.6 スクリプトエンジン

VBScript 5.7 スクリプトエンジン

VBScript 5.8 スクリプトエンジン

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0663	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0663
National Vulnerability Database (NVD)
2	CVE-2011-0663	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0663

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-189	https://jvndb.jvn.jp/ja/cwe/CWE-189.html

ベンダー情報

No	Name	URL
Microsoft Security Bulletin
1	MS11-031	http://www.microsoft.com/technet/security/bulletin/MS11-031.mspx
マイクロソフトセキュリティ情報
2	MS11-031	http://www.microsoft.com/japan/technet/security/bulletin/MS11-031.mspx
富士通セキュリティ情報
3	TA11-102A	http://software.fujitsu.com/jp/security/vulnerabilities/ta11-102a.html
絵でみるセキュリティ情報
4	MS11-031e	http://www.microsoft.com/japan/security/bulletins/MS11-031e.mspx

その他

No	Name	URL
JPCERT 緊急報告
1	JPCERT-AT-2011-0008	https://www.jpcert.or.jp/at/2011/at110008.txt
JVN
2	JVNTA11-102A	http://jvn.jp/cert/JVNTA11-102A
OPEN SOURCE VULNERABILITY DATABASE (OSVDB)
3	71774	http://osvdb.org/71774
Secunia Advisory
4	SA44162	http://secunia.com/advisories/44162
SecurityFocus
5	47249	http://www.securityfocus.com/bid/47249
SecurityTracker
6	1025333	http://www.securitytracker.com/id?1025333
US-CERT Cyber Security Alerts
7	SA11-102A	http://www.us-cert.gov/cas/alerts/SA11-102A.html
US-CERT Technical Cyber Security Alert
8	TA11-102A	http://www.us-cert.gov/cas/techalerts/TA11-102A.html
VUPEN Security
9	VUPEN/ADV-2011-0949	http://www.vupen.com/english/advisories/2011/0949
警察庁 @police
10	マイクロソフト社のセキュリティ修正プログラムについて(MS11-018,019,020,021,022,023,024,025,026,027,028,029,030,031,032,033,034)	http://www.npa.go.jp/cyberpolice/#topics

Change Log

No	Changed Details	Date of change
0	[2011年05月02日] 掲載	Feb. 17, 2018, 10:37 a.m.

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:microsoft:jscript:5.7:::::::*
cpe:2.3:a:microsoft:vbscript:5.7:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
3	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
4	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
5	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
6	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
7	cpe:2.3:o:microsoft:windows_server_2008:::itanium:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
9	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
10	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
11	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
12	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:microsoft:jscript:5.8:::::::*
cpe:2.3:a:microsoft:vbscript:5.8:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows_2003_server::sp2::::::*
2	cpe:2.3:o:microsoft:windows_7:-:sp1:x64:::::*
3	cpe:2.3:o:microsoft:windows_7:-:sp1:x86:::::*
4	cpe:2.3:o:microsoft:windows_7:-:::::::*
5	cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
6	cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
7	cpe:2.3:o:microsoft:windows_server_2008:::x32:::::*
8	cpe:2.3:o:microsoft:windows_server_2008:::x64:::::*
9	cpe:2.3:o:microsoft:windows_server_2008::sp2:x32:::::
10	cpe:2.3:o:microsoft:windows_server_2008:r2::itanium:::::
11	cpe:2.3:o:microsoft:windows_server_2008:r2::x64:::::
12	cpe:2.3:o:microsoft:windows_vista::sp1::::::*
13	cpe:2.3:o:microsoft:windows_vista::sp2::::::*
14	cpe:2.3:o:microsoft:windows_xp::sp3::::::*
15	cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*