漏洞信息详情

Microsoft Remote Desktop Connection ActiveX Control 堆缓冲区溢出漏洞

• CNNVD编号：CNNVD-200908-138
• 危害等级： 超危
  
• CVE编号： CVE-2009-1929
• 漏洞类型： 缓冲区溢出
• 发布时间： 2009-08-12
• 威胁类型： 远程
• 更新时间： 2009-08-13
• 厂        商： microsoft
• 漏洞来源： Yamata Li

漏洞简介

Microsoft Terminal Services Client ActiveX 控件在Windows XP SP2，Vista SP1 或 SP2， 又或 Server 2008 Gold 或 SP2上的 RDP 6.1， ; 或Windows XP SP3上的 5.2 或 6.1中存在的基于堆缓冲区溢出漏洞会允许远程攻击者通过对未明方法函数的未名参数来执行任意代码，改漏洞又称作 \"远程桌面连接ActiveX控件堆溢出漏洞\"。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接： Microsoft RDP 6.1 Microsoft Security Update for Windows Server 2008 (KB956744) http://www.microsoft.com/downloads/details.aspx?familyid=71c17a87-710b -434d-9b2a-2f471674915a Microsoft Security Update for Windows Server 2008 for Itanium-based Systems (KB956744) http://www.microsoft.com/downloads/details.aspx?familyid=65d0af4e-22a2 -4524-a003-2f4858012fa8 Microsoft Security Update for Windows Server 2008 x64 Edition (KB956744) http://www.microsoft.com/downloads/details.aspx?familyid=f095d2d5-4513 -4ae1-96c7-cbcf83304261 Microsoft Security Update for Windows Vista (KB956744) http://www.microsoft.com/downloads/details.aspx?familyid=cf95a552-f6fd -4e35-815a-d16c015cd3ea Microsoft Security Update for Windows Vista for x64-based Systems (KB956744) http://www.microsoft.com/downloads/details.aspx?familyid=5e19cef7-2413 -4575-9597-c6273a097aad Microsoft Security Update for Windows XP (KB956744) http://www.microsoft.com/downloads/details.aspx?familyid=d1f82d76-eeb2 -4ff4-9d2c-46882f214719 Microsoft Security Update for Windows XP x64 Edition (KB956744) http://www.microsoft.com/downloads/details.aspx?familyid=5061615f-fa8f -465f-ac8f-393998b7e91b

参考网址

来源: US-CERT 名称: TA09-223A 链接:http://www.us-cert.gov/cas/techalerts/TA09-223A.HTML 来源: VUPEN 名称: ADV-2009-2238 链接:http://www.vupen.com/english/advisories/2009/2238 来源: BID 名称: 35973 链接:http://www.securityfocus.com/bid/35973 来源: MS 名称: MS09-044 链接:http://www.microsoft.com/technet/security/Bulletin/MS09-044.mspx 来源: SECTRACK 名称: 1022709 链接:http://www.securitytracker.com/id?1022709 来源: SECUNIA 名称: 36229 链接:http://secunia.com/advisories/36229 来源: OSVDB 名称: 56912 链接:http://osvdb.org/56912

受影响实体

• Microsoft Windows_server_2008:-:Sp2:Itanium  
• Microsoft Windows_server_2008:Itanium  
• Microsoft Windows_server_2008:Sp2:X64  
• Microsoft Windows_server_2008:-:Sp2:X32  
• Microsoft Windows_server_2008:-:-:X64  

补丁

暂无