製品・ソフトウェアに関する情報

JVN脆弱性詳細

Google Chrome で使用される Microsoft Windows のカーネルモードドライバにおける任意のコードを実行される脆弱性

タイトル	Google Chrome で使用される Microsoft Windows のカーネルモードドライバにおける任意のコードを実行される脆弱性
概要	Google Chrome および他の製品で使用される Microsoft Windows のカーネルモードドライバは、メモリのオブジェクトを適切に処理しないため、任意のコードを実行される脆弱性が存在します。マイクロソフトセキュリティ情報には、この脆弱性は「TrueType フォントの解析の脆弱性」と記載されています。
想定される影響	第三者により、巧妙に細工された TrueType フォントファイルを介して、任意のコードを実行される可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2012年9月25日0:00
登録日	2012年9月28日11:54
最終更新日	2012年11月16日11:09

CVSS2.0 : 危険
スコア	10
ベクター	AV:N/AC:L/Au:N/C:C/I:C/A:C

影響を受けるシステム

マイクロソフト

Microsoft Windows 7 (x32) SP1 以前

Microsoft Windows 7 (x64) SP1 以前

Microsoft Windows 8 for 32-bit Systems

Microsoft Windows 8 for 64-bit Systems

Microsoft Windows RT

Microsoft Windows Server 2003 (itanium) SP2

Microsoft Windows Server 2003 (x64) SP2

Microsoft Windows Server 2003 SP2

Microsoft Windows Server 2008 (itanium) SP2

Microsoft Windows Server 2008 (x64) SP2

Microsoft Windows Server 2008 (x86) SP2

Microsoft Windows Server 2008 r2(itanium) SP1 以前

Microsoft Windows Server 2008 r2(x64) SP1 以前

Microsoft Windows Server 2012

Microsoft Windows Vista (x64) SP2

Microsoft Windows Vista SP2

Microsoft Windows XP (x64) SP2

Microsoft Windows XP sp3 SP3

Google

Google Chrome 22.0.1229.79 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-2897	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2897
National Vulnerability Database (NVD)
2	CVE-2012-2897	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2897

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	名前	URL
Google
1	Google Chrome	http://www.google.co.jp/chrome/intl/ja/landing_ff_yt.html?hl=ja&hl=ja
2	Stable Channel Update	http://googlechromereleases.blogspot.jp/2012/09/stable-channel-update_25.html
Microsoft Security Bulletin
3	MS12-075	http://technet.microsoft.com/en-us/security/bulletin/ms12-075
マイクロソフトセキュリティ情報
4	MS12-075	http://technet.microsoft.com/ja-jp/security/bulletin/ms12-075
富士通セキュリティ情報
5	TA12-318A	http://software.fujitsu.com/jp/security/vulnerabilities/ta12-318a.html

その他

No	名前	URL
JPCERT 注意喚起
1	JPCERT-AT-2012-0035	http://www.jpcert.or.jp/at/2012/at120035.txt
JVN
2	JVNTA12-318A	http://jvn.jp/cert/JVNTA12-318A
US-CERT Cyber Security Alerts
3	TA12-318A	http://www.us-cert.gov/cas/techalerts/TA12-318A.html
警察庁 @police
4	マイクロソフト社のセキュリティ修正プログラムについて(MS12-071,072,073,074,075,076)(2012年11月14日)	http://www.npa.go.jp/cyberpolice/#topics

変更履歴

No	変更内容	変更日
0	[2012年09月28日] 掲載 [2012年10月22日] CVSS による深刻度：基本値と攻撃条件の複雑さ、機密性、完全性、可用性への影響を変更 CWE による脆弱性タイプ一覧：CWE-ID を変更 [2012年11月16日] タイトル：NVD の変更に伴い内容を更新概要：NVD の変更に伴い内容を更新想定される影響：NVD の変更に伴い内容を更新影響を受けるシステム：マイクロソフト (MS12-075) の情報を追加ベンダ情報：マイクロソフト (MS12-075) を追加[2012年11月16日] ベンダ情報：富士通 (TA12-318A) を追加	2018年2月17日10:37

NVD脆弱性情報

CVE-2012-2897

概要	The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT, as used by Google Chrome before 22.0.1229.79 and other programs, do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a crafted TrueType font file, aka "Windows Font Parsing Vulnerability" or "TrueType Font Parsing Vulnerability."
公表日	2012年9月26日19:56
登録日	2021年1月28日14:59
最終更新日	2024年11月21日10:39

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:google:chrome::::::::		22.0.1229.78
cpe:2.3:a:google:chrome:22.0.1229.0:::::::*
cpe:2.3:a:google:chrome:22.0.1229.1:::::::*
cpe:2.3:a:google:chrome:22.0.1229.2:::::::*
cpe:2.3:a:google:chrome:22.0.1229.3:::::::*
cpe:2.3:a:google:chrome:22.0.1229.4:::::::*
cpe:2.3:a:google:chrome:22.0.1229.6:::::::*
cpe:2.3:a:google:chrome:22.0.1229.7:::::::*
cpe:2.3:a:google:chrome:22.0.1229.8:::::::*
cpe:2.3:a:google:chrome:22.0.1229.9:::::::*
cpe:2.3:a:google:chrome:22.0.1229.10:::::::*
cpe:2.3:a:google:chrome:22.0.1229.11:::::::*
cpe:2.3:a:google:chrome:22.0.1229.12:::::::*
cpe:2.3:a:google:chrome:22.0.1229.14:::::::*
cpe:2.3:a:google:chrome:22.0.1229.16:::::::*
cpe:2.3:a:google:chrome:22.0.1229.17:::::::*
cpe:2.3:a:google:chrome:22.0.1229.18:::::::*
cpe:2.3:a:google:chrome:22.0.1229.20:::::::*
cpe:2.3:a:google:chrome:22.0.1229.21:::::::*
cpe:2.3:a:google:chrome:22.0.1229.22:::::::*
cpe:2.3:a:google:chrome:22.0.1229.23:::::::*
cpe:2.3:a:google:chrome:22.0.1229.24:::::::*
cpe:2.3:a:google:chrome:22.0.1229.25:::::::*
cpe:2.3:a:google:chrome:22.0.1229.26:::::::*
cpe:2.3:a:google:chrome:22.0.1229.27:::::::*
cpe:2.3:a:google:chrome:22.0.1229.28:::::::*
cpe:2.3:a:google:chrome:22.0.1229.29:::::::*
cpe:2.3:a:google:chrome:22.0.1229.31:::::::*
cpe:2.3:a:google:chrome:22.0.1229.32:::::::*
cpe:2.3:a:google:chrome:22.0.1229.33:::::::*
cpe:2.3:a:google:chrome:22.0.1229.35:::::::*
cpe:2.3:a:google:chrome:22.0.1229.36:::::::*
cpe:2.3:a:google:chrome:22.0.1229.37:::::::*
cpe:2.3:a:google:chrome:22.0.1229.39:::::::*
cpe:2.3:a:google:chrome:22.0.1229.48:::::::*
cpe:2.3:a:google:chrome:22.0.1229.49:::::::*
cpe:2.3:a:google:chrome:22.0.1229.50:::::::*
cpe:2.3:a:google:chrome:22.0.1229.51:::::::*
cpe:2.3:a:google:chrome:22.0.1229.52:::::::*
cpe:2.3:a:google:chrome:22.0.1229.53:::::::*
cpe:2.3:a:google:chrome:22.0.1229.54:::::::*
cpe:2.3:a:google:chrome:22.0.1229.55:::::::*
cpe:2.3:a:google:chrome:22.0.1229.56:::::::*
cpe:2.3:a:google:chrome:22.0.1229.57:::::::*
cpe:2.3:a:google:chrome:22.0.1229.58:::::::*
cpe:2.3:a:google:chrome:22.0.1229.59:::::::*
cpe:2.3:a:google:chrome:22.0.1229.60:::::::*
cpe:2.3:a:google:chrome:22.0.1229.62:::::::*
cpe:2.3:a:google:chrome:22.0.1229.63:::::::*
cpe:2.3:a:google:chrome:22.0.1229.64:::::::*
cpe:2.3:a:google:chrome:22.0.1229.65:::::::*
cpe:2.3:a:google:chrome:22.0.1229.67:::::::*
cpe:2.3:a:google:chrome:22.0.1229.76:::::::*
cpe:2.3:o:microsoft:windows_7:-:sp1:x86:::::*
cpe:2.3:o:microsoft:windows_7:-:::::::*
cpe:2.3:o:microsoft:windows_7:-:sp1:x64:::::*
cpe:2.3:o:microsoft:windows_8:-:-:x86:::::*
cpe:2.3:o:microsoft:windows_8:-:-:x64:::::*
cpe:2.3:o:microsoft:windows_rt:-:::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_server_2008::sp2:x86:::::
cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:itanium:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
cpe:2.3:o:microsoft:windows_vista::sp2::::::*
cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

構成1	以上	以下	より上	未満
cpe:2.3:a:google:chrome::::::::		22.0.1229.78
cpe:2.3:a:google:chrome:22.0.1229.0:::::::*
cpe:2.3:a:google:chrome:22.0.1229.1:::::::*
cpe:2.3:a:google:chrome:22.0.1229.2:::::::*
cpe:2.3:a:google:chrome:22.0.1229.3:::::::*
cpe:2.3:a:google:chrome:22.0.1229.4:::::::*
cpe:2.3:a:google:chrome:22.0.1229.6:::::::*
cpe:2.3:a:google:chrome:22.0.1229.7:::::::*
cpe:2.3:a:google:chrome:22.0.1229.8:::::::*
cpe:2.3:a:google:chrome:22.0.1229.9:::::::*
cpe:2.3:a:google:chrome:22.0.1229.10:::::::*
cpe:2.3:a:google:chrome:22.0.1229.11:::::::*
cpe:2.3:a:google:chrome:22.0.1229.12:::::::*
cpe:2.3:a:google:chrome:22.0.1229.14:::::::*
cpe:2.3:a:google:chrome:22.0.1229.16:::::::*
cpe:2.3:a:google:chrome:22.0.1229.17:::::::*
cpe:2.3:a:google:chrome:22.0.1229.18:::::::*
cpe:2.3:a:google:chrome:22.0.1229.20:::::::*
cpe:2.3:a:google:chrome:22.0.1229.21:::::::*
cpe:2.3:a:google:chrome:22.0.1229.22:::::::*
cpe:2.3:a:google:chrome:22.0.1229.23:::::::*
cpe:2.3:a:google:chrome:22.0.1229.24:::::::*
cpe:2.3:a:google:chrome:22.0.1229.25:::::::*
cpe:2.3:a:google:chrome:22.0.1229.26:::::::*
cpe:2.3:a:google:chrome:22.0.1229.27:::::::*
cpe:2.3:a:google:chrome:22.0.1229.28:::::::*
cpe:2.3:a:google:chrome:22.0.1229.29:::::::*
cpe:2.3:a:google:chrome:22.0.1229.31:::::::*
cpe:2.3:a:google:chrome:22.0.1229.32:::::::*
cpe:2.3:a:google:chrome:22.0.1229.33:::::::*
cpe:2.3:a:google:chrome:22.0.1229.35:::::::*
cpe:2.3:a:google:chrome:22.0.1229.36:::::::*
cpe:2.3:a:google:chrome:22.0.1229.37:::::::*
cpe:2.3:a:google:chrome:22.0.1229.39:::::::*
cpe:2.3:a:google:chrome:22.0.1229.48:::::::*
cpe:2.3:a:google:chrome:22.0.1229.49:::::::*
cpe:2.3:a:google:chrome:22.0.1229.50:::::::*
cpe:2.3:a:google:chrome:22.0.1229.51:::::::*
cpe:2.3:a:google:chrome:22.0.1229.52:::::::*
cpe:2.3:a:google:chrome:22.0.1229.53:::::::*
cpe:2.3:a:google:chrome:22.0.1229.54:::::::*
cpe:2.3:a:google:chrome:22.0.1229.55:::::::*
cpe:2.3:a:google:chrome:22.0.1229.56:::::::*
cpe:2.3:a:google:chrome:22.0.1229.57:::::::*
cpe:2.3:a:google:chrome:22.0.1229.58:::::::*
cpe:2.3:a:google:chrome:22.0.1229.59:::::::*
cpe:2.3:a:google:chrome:22.0.1229.60:::::::*
cpe:2.3:a:google:chrome:22.0.1229.62:::::::*
cpe:2.3:a:google:chrome:22.0.1229.63:::::::*
cpe:2.3:a:google:chrome:22.0.1229.64:::::::*
cpe:2.3:a:google:chrome:22.0.1229.65:::::::*
cpe:2.3:a:google:chrome:22.0.1229.67:::::::*
cpe:2.3:a:google:chrome:22.0.1229.76:::::::*
cpe:2.3:o:microsoft:windows_7:-:sp1:x86:::::*
cpe:2.3:o:microsoft:windows_7:-:::::::*
cpe:2.3:o:microsoft:windows_7:-:sp1:x64:::::*
cpe:2.3:o:microsoft:windows_8:-:-:x86:::::*
cpe:2.3:o:microsoft:windows_8:-:-:x64:::::*
cpe:2.3:o:microsoft:windows_rt:-:::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_server_2008::sp2:x86:::::
cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:itanium:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
cpe:2.3:o:microsoft:windows_vista::sp2::::::*
cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

No	URL	refsource	タグ
1	http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html
2	http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html
3	http://secunia.com/advisories/51239
4	http://secunia.com/advisories/51239
5	http://www.securitytracker.com/id?1027750
6	http://www.securitytracker.com/id?1027750
7	http://www.us-cert.gov/cas/techalerts/TA12-318A.html
8	http://www.us-cert.gov/cas/techalerts/TA12-318A.html
9	https://code.google.com/p/chromium/issues/detail?id=146254
10	https://code.google.com/p/chromium/issues/detail?id=146254
11	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-075
12	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-075
13	https://exchange.xforce.ibmcloud.com/vulnerabilities/78822
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/78822
15	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15847
16	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15847