Microsoft MSN Messenger PNG图片解析远程代码执行漏洞(MS05-009)

漏洞信息详情

Microsoft MSN Messenger PNG图片解析远程代码执行漏洞(MS05-009)

• CNNVD编号：CNNVD-200411-072
• 危害等级： 超危
  
  
• CVE编号：
  CVE-2004-0597
  
• 漏洞类型：
  
  
  未知
  
• 发布时间：
  
  2004-07-12
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2010-04-02
  
• 厂        商：
  
  microsoft
• 漏洞来源：
  Carlos Sarraute

Windows MSN Messenger是一款即时通信软件。
Windows MSN Messenger在处理畸形PNG文件时存在问题，远程攻击者可以利用这个漏洞构建恶意PNG文件，诱使用户处理，可导致缓冲区溢出。
Windows MSN Messenger在处理破坏或畸形的PNG文件时存在问题，目标用户被打开后可能被攻击者完全控制系统。

厂商补丁：
Microsoft
———
Microsoft已经为此发布了一个安全公告(MS05-009)以及相应补丁:

MS05-009：Vulnerability in PNG Processing Could Allow Remote Code Execution (890261)

链接：http://www.microsoft.com/technet/security/bulletin/ms05-009.mspx” target=”_blank”>
http://www.microsoft.com/technet/security/bulletin/ms05-009.mspx

补丁下载：

Microsoft Windows Messenger version 5.0 (standalone version that can be installed on all supported operating systems)

http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774

Microsoft MSN Messenger 6.1

http://www.microsoft.com/downloads/details.aspx?FamilyId=EBE898D8-FE1C-4A5E-993C-5FAB3E62C925” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=EBE898D8-FE1C-4A5E-993C-5FAB3E62C925

Microsoft MSN Messenger 6.2

http://www.microsoft.com/downloads/details.aspx?FamilyId=EBE898D8-FE1C-4A5E-993C-5FAB3E62C925” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=EBE898D8-FE1C-4A5E-993C-5FAB3E62C925

来源:US-CERT Technical Alert: TA05-039A
名称: TA05-039A
链接:http://www.us-cert.gov/cas/techalerts/TA05-039A.html

来源:US-CERT Technical Alert: TA04-217A
名称: TA04-217A
链接:http://www.us-cert.gov/cas/techalerts/TA04-217A.html

来源:US-CERT Vulnerability Note: VU#817368
名称: VU#817368
链接:http://www.kb.cert.org/vuls/id/817368

来源:US-CERT Vulnerability Note: VU#388984
名称: VU#388984
链接:http://www.kb.cert.org/vuls/id/388984

来源: FEDORA
名称: FLSA:1943
链接:https://bugzilla.fedora.us/show_bug.cgi?id=1943

来源: XF
名称: libpng-pnghandle-bo(16894)
链接:http://xforce.iss.net/xforce/xfdb/16894

来源: TRUSTIX
名称: 2004-0040
链接:http://www.trustix.net/errata/2004/0040/

来源: BID
名称: 10857
链接:http://www.securityfocus.com/bid/10857

来源: SUSE
名称: SUSE-SA:2004:023
链接:http://www.novell.com/linux/security/advisories/2004_23_libpng.html

来源: MS
名称: MS05-009
链接:http://www.microsoft.com/technet/security/bulletin/ms05-009.mspx

来源: GENTOO
名称: GLSA-200408-22
链接:http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml

来源: GENTOO
名称: GLSA-200408-03
链接:http://www.gentoo.org/security/en/glsa/glsa-200408-03.xml

来源: DEBIAN
名称: DSA-536
链接:http://www.debian.org/security/2004/dsa-536

来源: www.adobe.com
链接:http://www.adobe.com/support/downloads/detail.jsp?ftpID=2679

来源: BID
名称: 15495
链接:http://www.securityfocus.com/bid/15495

来源: REDHAT
名称: RHSA-2004:429
链接:http://www.redhat.com/support/errata/RHSA-2004-429.html

来源: REDHAT
名称: RHSA-2004:421
链接:http://www.redhat.com/support/errata/RHSA-2004-421.html

来源: REDHAT
名称: RHSA-2004:402
链接:http://www.redhat.com/support/errata/RHSA-2004-402.html

来源: www.mozilla.org
链接:http://www.mozilla.org/projects/security/known-vulnerabilities.html

来源: www.coresecurity.com
链接:http://www.coresecurity.com/common/showdoc.php?idx=421&idxseccion=10

来源: scary.beasts.org
链接:http://scary.beasts.org/security/CESA-2004-001.txt

来源: OVAL
名称: oval:org.mitre.oval:def:7709
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7709

来源: OVAL
名称: oval:org.mitre.oval:def:11284
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11284

来源: BUGTRAQ
名称: 20050209 MSN Messenger PNG Image Buffer Overflow Download Shellcoded Exploit
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=110796779903455&w=2

来源: FEDORA
名称: FLSA:2089
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109900315219363&w=2

来源: SCO
名称: SCOSA-2004.16
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109761239318458&w=2

来源: HP
名称: SSRT4778
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109181639602978&w=2

来源: BUGTRAQ
名称: 20040804 [OpenPKG-SA-2004.035] OpenPKG Security Advisory (png)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109163866717909&w=2

来源: CONECTIVA
名称: CLA-2004:856
链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856

来源: SCO
名称: SCOSA-2005.49
链接:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt

来源: MANDRIVA
名称: MDKSA-2006:213
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2006:213

来源: MANDRIVA
名称: MDKSA-2006:212
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2006:212

来源: MANDRAKE
名称: MDKSA-2004:079
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2004:079

来源: sunsolve.sun.com
链接:http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-114816-02-1

来源: SUNALERT
名称: 200663
链接:http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1

来源: SECUNIA
名称: 22958
链接:http://secunia.com/advisories/22958

来源: SECUNIA
名称: 22957
链接:http://secunia.com/advisories/22957

来源: US Government Resource: oval:org.mitre.oval:def:594
名称: oval:org.mitre.oval:def:594
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:594

来源: US Government Resource: oval:org.mitre.oval:def:4492
名称: oval:org.mitre.oval:def:4492
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:4492

来源: US Government Resource: oval:org.mitre.oval:def:2378
名称: oval:org.mitre.oval:def:2378
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2378

来源: US Government Resource: oval:org.mitre.oval:def:2274
名称: oval:org.mitre.oval:def:2274
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2274