Microsoft Word文件解析溢出(MS05-023)

漏洞信息详情

Microsoft Word文件解析溢出(MS05-023)

• CNNVD编号：CNNVD-200502-039
• 危害等级： 超危
  
  
• CVE编号：
  CVE-2004-0963
  
• 漏洞类型：
  
  
  缓冲区溢出
  
• 发布时间：
  
  2005-02-09
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-10-20
  
• 厂        商：
  
  microsoft
• 漏洞来源：
  Microsoft Security…

Microsoft Word是微软发布的非常流行的办公软件。
Microsoft Word中存在缓冲区溢出漏洞，起因是winword.exe在解析文档文件时缺少数据验证，这样就可能通过修改*.doc文件中的数据触发异常。
成功利用这个漏洞的攻击者可以完全控制受影响的系统，然后攻击者就可以安装程序，浏览，更改或删除数据，或创建拥有完全权限的新帐号。在系统中配置为较少权限的帐号比以管理权限操作用户所受威胁要小。

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：
Microsoft Word 2003
Microsoft Security Update for Word 2003 (KB887979)
http://www.microsoft.com/downloads/details.aspx?familyid=9158279D-4421 -4932-9318-02CA829A9B43&displaylang=en
Microsoft Word 2000 Japanese Version
Microsoft Security Update for Word 2000 (KB887977)
http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en
Microsoft Word 2002 SP1
Microsoft Security Update for Word 2002 (KB887978)
http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en
Microsoft Word 2003 Viewer
Microsoft Word Viewer 2003
http://www.microsoft.com/downloads/details.aspx?familyid=95E24C87-8732 -48D5-8689-AB826E7B8FDF&displaylang=en
Microsoft Works Suite 2003
Microsoft Security Update for Word 2002 (KB887978)
http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en
Microsoft Word 2000
Microsoft Security Update for Word 2000 (KB887977)
http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en
Microsoft Works Suite 2002
Microsoft Security Update for Word 2002 (KB887978)
http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en
Microsoft Word 2000 SR1a
Microsoft Security Update for Word 2000 (KB887977)
http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en
Microsoft Works Suite 2001
Microsoft Security Update for Word 2000 (KB887977)
http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en
Microsoft Word 2000 Korean Version
Microsoft Security Update for Word 2000 (KB887977)
http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en
Microsoft Works Suite 2004
Microsoft Security Update for Word 2002 (KB887978)
http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en
Microsoft Word 2002 SP2
Microsoft Security Update for Word 2002 (KB887978)
http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en
Microsoft Word 2000 SR1
Microsoft Security Update for Word 2000 (KB887977)
http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en
Microsoft Word 2000 Chinese Version
Microsoft Security Update for Word 2000 (KB887977)
http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en
Microsoft Word 2002
Microsoft Security Update for Word 2002 (KB887978)
http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en
Microsoft Word 2000 SP3
Microsoft Security Update for Word 2000 (KB887977)
http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en
Microsoft Word 2000 SP2
Microsoft Security Update for Word 2000 (KB887977)
http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en
Microsoft Word 2002 SP3
Microsoft Security Update for Word 2002 (KB887978)
http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en

来源: XF
名称: word-file-parsing-bo(17635)
链接:http://xforce.iss.net/xforce/xfdb/17635

来源: MS
名称: MS05-023
链接:http://www.microsoft.com/technet/Security/bulletin/ms05-023.mspx

来源: BUGTRAQ
名称: 20041006 [HV-HIGH] MS Word multiple exceptions, at least one exploitable
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109716247230733&w=2

来源: US Government Resource: oval:org.mitre.oval:def:420
名称: oval:org.mitre.oval:def:420
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:420

来源: US Government Resource: oval:org.mitre.oval:def:2216
名称: oval:org.mitre.oval:def:2216
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2216

来源: US Government Resource: oval:org.mitre.oval:def:2105
名称: oval:org.mitre.oval:def:2105
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2105

来源: US Government Resource: oval:org.mitre.oval:def:1795
名称: oval:org.mitre.oval:def:1795
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1795