NCHOVY 인터넷 스톰 센터 : CVE-2010-0027

전세계

한국

CVE-2010-0027
기본정보	공개일 : 2010-01-22 변경일 : 2010-07-20 위험도 : 낮음 공격 범위 : 인터넷, 사용자가 공격자에게 접근해야 공격 가능 피해 유형 : 무결성 훼손, 기밀 유출, 가용성 침해
CVSS 평가	위험도: 9.3 (영향도: 10.0 익스플로잇: 8.6 )
설명	The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, does not properly process input parameters, which allows remote attackers to execute arbitrary local programs via a crafted URL, aka "URL Validation Vulnerability."
참조	CERT, TA10-040A MS 보안 권고문, 패치, MS10-007 MISC, http://www.zerodayinitiative.com/advisories/ZDI-10-016/ BUGTRAQ, 20100209 ZDI-10-016: Microsoft Windows ShellExecute Improper Sanitiza.. XF, ie-url-code-execution(55773) MS 보안 권고문, 패치, MS10-002
취약 소프트웨어	Microsoft windows_server_2008 r2:itanium Microsoft windows_server_2008 r2:x64 Microsoft windows_server_2008 r2 Microsoft windows_server_2008 :x64 Microsoft windows_server_2008 :x32 Microsoft windows_server_2003 sp2:itanium Microsoft windows_server_2003 sp2:x64 Microsoft windows_server_2003 sp2 Microsoft windows_7 - -:x64 Microsoft windows_7 - -:x32 Microsoft windows_7 - - Microsoft windows_2003_server sp2:itanium Microsoft windows_2003_server sp2 Microsoft windows_2000 sp4 Microsoft ie 8.0.6001 Microsoft ie 8 Microsoft ie 7.00.6000.16441 Microsoft ie 7.00.6000.16386 Microsoft ie 7.00.5730.1100 Microsoft ie 7.0.5730.11 Microsoft ie 7.0.5730 unknown:gold Microsoft ie 7.0.5730 unknown Microsoft ie 7.0 Microsoft ie 7 Microsoft ie 6 sp1 Microsoft ie 5.01 sp4 Microsoft windows_xp - sp2:x64 Microsoft windows_xp - sp2 Microsoft windows_xp sp3 Microsoft windows_xp sp2 Microsoft windows_vista sp2:x64 Microsoft windows_vista sp2 Microsoft windows_vista sp1:x64 Microsoft windows_vista sp1 Microsoft windows_vista :x64 Microsoft windows_server_2008 sp2:x64 Microsoft windows_server_2008 sp2:x32 Microsoft windows_server_2008 sp2