漏洞信息详情

Microsoft Word文件解析溢出(MS05-023)

• CNNVD编号：CNNVD-200502-039
• 危害等级： 超危
  
• CVE编号： CVE-2004-0963
• 漏洞类型： 缓冲区溢出
• 发布时间： 2005-02-09
• 威胁类型： 远程
• 更新时间： 2005-10-20
• 厂        商： microsoft
• 漏洞来源： Microsoft Security...

漏洞简介

Microsoft Word是微软发布的非常流行的办公软件。 Microsoft Word中存在缓冲区溢出漏洞，起因是winword.exe在解析文档文件时缺少数据验证，这样就可能通过修改*.doc文件中的数据触发异常。 成功利用这个漏洞的攻击者可以完全控制受影响的系统，然后攻击者就可以安装程序，浏览，更改或删除数据，或创建拥有完全权限的新帐号。在系统中配置为较少权限的帐号比以管理权限操作用户所受威胁要小。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接： Microsoft Word 2003 Microsoft Security Update for Word 2003 (KB887979) http://www.microsoft.com/downloads/details.aspx?familyid=9158279D-4421 -4932-9318-02CA829A9B43&displaylang=en Microsoft Word 2000 Japanese Version Microsoft Security Update for Word 2000 (KB887977) http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en Microsoft Word 2002 SP1 Microsoft Security Update for Word 2002 (KB887978) http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en Microsoft Word 2003 Viewer Microsoft Word Viewer 2003 http://www.microsoft.com/downloads/details.aspx?familyid=95E24C87-8732 -48D5-8689-AB826E7B8FDF&displaylang=en Microsoft Works Suite 2003 Microsoft Security Update for Word 2002 (KB887978) http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en Microsoft Word 2000 Microsoft Security Update for Word 2000 (KB887977) http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en Microsoft Works Suite 2002 Microsoft Security Update for Word 2002 (KB887978) http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en Microsoft Word 2000 SR1a Microsoft Security Update for Word 2000 (KB887977) http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en Microsoft Works Suite 2001 Microsoft Security Update for Word 2000 (KB887977) http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en Microsoft Word 2000 Korean Version Microsoft Security Update for Word 2000 (KB887977) http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en Microsoft Works Suite 2004 Microsoft Security Update for Word 2002 (KB887978) http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en Microsoft Word 2002 SP2 Microsoft Security Update for Word 2002 (KB887978) http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en Microsoft Word 2000 SR1 Microsoft Security Update for Word 2000 (KB887977) http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en Microsoft Word 2000 Chinese Version Microsoft Security Update for Word 2000 (KB887977) http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en Microsoft Word 2002 Microsoft Security Update for Word 2002 (KB887978) http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en Microsoft Word 2000 SP3 Microsoft Security Update for Word 2000 (KB887977) http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en Microsoft Word 2000 SP2 Microsoft Security Update for Word 2000 (KB887977) http://www.microsoft.com/downloads/details.aspx?familyid=9F4B6868-2F94 -478F-B0BC-0DA3E0571523&displaylang=en Microsoft Word 2002 SP3 Microsoft Security Update for Word 2002 (KB887978) http://www.microsoft.com/downloads/details.aspx?familyid=34998255-E004 -4A29-9418-35C5818E54CB&displaylang=en

参考网址

来源: XF 名称: word-file-parsing-bo(17635) 链接:http://xforce.iss.net/xforce/xfdb/17635 来源: MS 名称: MS05-023 链接:http://www.microsoft.com/technet/Security/bulletin/ms05-023.mspx 来源: BUGTRAQ 名称: 20041006 [HV-HIGH] MS Word multiple exceptions, at least one exploitable 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109716247230733&w=2 来源: US Government Resource: oval:org.mitre.oval:def:420 名称: oval:org.mitre.oval:def:420 链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:420 来源: US Government Resource: oval:org.mitre.oval:def:2216 名称: oval:org.mitre.oval:def:2216 链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2216 来源: US Government Resource: oval:org.mitre.oval:def:2105 名称: oval:org.mitre.oval:def:2105 链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2105 来源: US Government Resource: oval:org.mitre.oval:def:1795 名称: oval:org.mitre.oval:def:1795 链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1795

受影响实体

• Microsoft Word:2002:Sp3  

补丁

暂无