Microsoft Windows Internet Explorer CSS堆内存破坏漏洞(MS04-038)

漏洞信息详情

Microsoft Windows Internet Explorer CSS堆内存破坏漏洞(MS04-038)

• CNNVD编号：CNNVD-200412-119
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2004-0842
  
• 漏洞类型：
  
  
  边界条件错误
  
• 发布时间：
  
  2004-10-12
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2006-04-07
  
• 厂        商：
  
  avaya
• 漏洞来源：
  Microsoft Security…

Microsoft Internet Explorer是一款流行的WEB浏览器。
Microsoft Internet Explorer CSS存在堆内存破坏，远程攻击者可以利用这个漏洞可能以IE进程权限在系统上执行任意指令。
攻击者可以通过构建恶意WEB页诱使用户访问，正确利用此漏洞可能完全控制目标用户的系统，不过此漏洞需要用户交互才能利用此漏洞。

厂商补丁：
Microsoft
———
Microsoft已经为此发布了一个安全公告(MS04-038)以及相应补丁:

MS04-038：Cumulative Security Update for Internet Explorer (834707)

链接：http://www.microsoft.com/technet/security/bulletin/MS04-038.mspx” target=”_blank”>
http://www.microsoft.com/technet/security/bulletin/MS04-038.mspx

补丁下载：

Internet Explorer 5.01 Service Pack 3 on Windows 2000 SP3

http://www.microsoft.com/downloads/details.aspx?FamilyId=2D8E8E97-4946-4994-924B-1FB1DC1881BA&displaylang=en” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=2D8E8E97-4946-4994-924B-1FB1DC1881BA&displaylang=en

Internet Explorer 5.01 Service Pack 4 on Windows 2000 SP4

http://www.microsoft.com/downloads/details.aspx?FamilyId=72DBE239-AF0A-42B5-B88C-A00371F6EC81&displaylang=en” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=72DBE239-AF0A-42B5-B88C-A00371F6EC81&displaylang=en

Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Me

http://www.microsoft.com/downloads/details.aspx?FamilyId=BE27F77C-3C2D-45F1-86DF-2B71799DA169&displaylang=en” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=BE27F77C-3C2D-45F1-86DF-2B71799DA169&displaylang=en

Internet Explorer 6 on Windows XP

http://www.microsoft.com/downloads/details.aspx?FamilyId=A89CFBE8-C299-415D-A9D6-7CC6429C547D&displaylang=en” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=A89CFBE8-C299-415D-A9D6-7CC6429C547D&displaylang=en

Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3, on Microsoft Windows 2000 Service Pack 4, on Microsoft Windows XP, or on Microsoft Windows XP Service Pack 1

http://www.microsoft.com/downloads/details.aspx?FamilyId=7C1404E6-F5D4-4FED-9573-DD83F2DFF074&displaylang=en” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=7C1404E6-F5D4-4FED-9573-DD83F2DFF074&displaylang=en

Internet Explorer 6 Service Pack 1 on Microsoft Windows NT Server 4.0 Service Pack 6a, on Microsoft Windows NT Server 4.0 Terminal Service Edition Service Pack 6, on Microsoft Windows 98, on Microsoft Windows 98 SE, or on Microsoft Windows Me

http://www.microsoft.com/downloads/details.aspx?FamilyId=DE8D94C4-7F58-4CE7-B8BD-51CFD795B03E&displaylang=en” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=DE8D94C4-7F58-4CE7-B8BD-51CFD795B03E&displaylang=en

Internet Explorer 6 for Windows XP Service Pack 1 (64-Bit Edition)

http://www.microsoft.com/downloads/details.aspx?FamilyId=C05103E8-4402-4D54-BA03-FBBC24142E4D&displaylang=en” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=C05103E8-4402-4D54-BA03-FBBC24142E4D&displaylang=en

Internet Explorer 6 for Windows Server 2003

http://www.microsoft.com/downloads/details.aspx?FamilyId=19E69E5F-9C98-49AD-A61F-4F82A4014412&displaylang=en” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=19E69E5F-9C98-49AD-A61F-4F82A4014412&displaylang=en

Internet Explorer 6 for Windows Server 2003 64-Bit Edition and Windows XP 64-Bit Edition Version 2003

http://www.microsoft.com/downloads/details.aspx?FamilyId=566C2A05-2513-4E30-A3EA-87D4BF7F9730&displaylang=en” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=566C2A05-2513-4E30-A3EA-87D4BF7F9730&displaylang=en

Internet Explorer 6 for Windows XP Service Pack 2

http://www.microsoft.com/downloads/details.aspx?FamilyId=CF47B515-3F51-43E1-9246-2C2264C49E2E&displaylang=en” target=”_blank”>
http://www.microsoft.com/downloads/details.aspx?FamilyId=CF47B515-3F51-43E1-9246-2C2264C49E2E&displaylang=en

来源:US-CERT Technical Alert: TA04-293A
名称: TA04-293A
链接:http://www.us-cert.gov/cas/techalerts/TA04-293A.html

来源:US-CERT Vulnerability Note: VU#291304
名称: VU#291304
链接:http://www.kb.cert.org/vuls/id/291304

来源: BID
名称: 10816
链接:http://www.securityfocus.com/bid/10816

来源: www.securiteam.com
链接:http://www.securiteam.com/exploits/5NP042KF5A.html

来源: MS
名称: MS04-038
链接:http://www.microsoft.com/technet/security/bulletin/ms04-038.asp

来源: www.ecqurity.com
链接:http://www.ecqurity.com/adv/IEstyle.html

来源: BUGTRAQ
名称: 20040728 Re: Crash IE with 11 bytes 😉
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109107496214572&w=2

来源: XF
名称: ie-popupshow-perform-actions(16675)
链接:http://xforce.iss.net/xforce/xfdb/16675

来源: CIAC
名称: P-006
链接:http://www.ciac.org/ciac/bulletins/p-006.shtml

来源: SECUNIA
名称: 12806
链接:http://secunia.com/advisories/12806

来源: FULLDISC
名称: 20040728 Re: Crash IE with 11 bytes 😉
链接:http://marc.theaimsgroup.com/?l=full-disclosure&m=109102919426844&w=2

来源: FULLDISC
名称: 20040723 Crash IE with 11 bytes 😉
链接:http://marc.theaimsgroup.com/?l=full-disclosure&m=109060455614702&w=2

来源: US Government Resource: oval:org.mitre.oval:def:6579
名称: oval:org.mitre.oval:def:6579
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6579

来源: US Government Resource: oval:org.mitre.oval:def:5592
名称: oval:org.mitre.oval:def:5592
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5592

来源: US Government Resource: oval:org.mitre.oval:def:4169
名称: oval:org.mitre.oval:def:4169
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:4169

来源: US Government Resource: oval:org.mitre.oval:def:3372
名称: oval:org.mitre.oval:def:3372
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:3372

来源: US Government Resource: oval:org.mitre.oval:def:2906
名称: oval:org.mitre.oval:def:2906
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2906