$B%;%-%e%j%F%#%[!<%k(B memo - 2007.10

Last modified: Mon Jun 2 18:10:55 2008 +0900 (JST)


$B!!$3$N%Z!<%8$N>pJs$rMxMQ$5$l$kA0$K!"(B$BCm0U=q$-(B$B$r$*FI$_$/$@$5$$!#(B


$B"#(B 2007.10.31

$B"#(B $BDI5-(B

Windows Media Player $B%W%i%0%$%s$N@H

$B!!(BKB911564 $BF|K\8lHG(B $B$K$b!">e5-$HF1MM$NFbMF$,DI2C$5$l$?LOMM!#(B

Microsoft Windows Sever 2003 Service Pack 2 $B$r
Windows Update$B$r$3$C$=$j99?7!)!!!V%^%k%&%'%"!W8F$P$o$j$K(BMS$B$,

$B!!(BWindows Update$B$GH/@8$7$F$$$kIT6q9g!$(BMicrosoft$B$,=i$a$F%_%9$rG'$a$k(B ($BF|7P(B IT Pro, 2007.10.30)$B!#(BWindows IT Pro $B$NK]Lu5-;v!#(B

JVN#50495547 / JVN#32981509 / JVN#29211062: $B!V0lB@O:%7%j!<%:!W$K$*$1$k(B3$B$D$N%P%C%U%!%*!<%P!<%U%m!<$N@H

$B!!(B$B0lB@O:(Bplug-in$B$r(BIE$B$H(BFirefox$B$GL58z$K(B $B!A(B $B%8%c%9%H%7%9%F%`$OK\Ev$N6<0R$r65$($F$/$l$J$$(B ($B9bLZ9@8w!w<+Bp$NF|5-(B, 2007.10.30)$B!#(B $B8D?ME*$K$O!"%8%c%9%H%7%9%F%`$O$b$O$dC1$J$k%"%W%j%1!<%7%g%s%Y%s%@!<$G$O$J$/!"%"%s%A%&%$%k%9%=%U%H$r07$&%;%-%e%j%F%#%Y%s%@!<$H$J$C$?$K$b$+$+$o$i$:!"$3$&$$$&BVEY$@$H$$$&E@$,0lHV$NLdBj$@$H;W$&!#(B

$B!!JS$BJ8=q%S%e!<%"(B ActiveX$B%W%i%0%$%s(B ($B%8%c%9%H%7%9%F%`(B) $B$b%$%s%9%H!<%k$7$F$_$?$N$@$1$I!"(B $B%W%i%0%$%s$,$^$H$b$KF0:n$7$F$$$J$$$h$&$J$N$@$h$J$"!#$&!<$s!#4n$s$G$$$$$N$d$iHa$7$`$Y$-$J$N$d$i!#(B

$B!!!D!D$5$-$[$I!V%8%c%9%H%7%9%F%`!!%f!<%6!<%:!&%$%s%U%)%a!<%7%g%s!W(B $B$,N.$l$F$-$?!#(B

Date: Wed, 31 Oct 2007 13:57:04 +0900
To: users-information@justsystem.co.jp
From: Justsystem <users@justsystem.co.jp>
Subject: UsersInfo$B!Z0lB@O:$N!V%;%-%e%j%F%#99?7%b%8%e!<%k!W8x3+$N$*CN$i$;![(B10/31
($BCfN,(B)
$B(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(B
$B!!!!!!!!!!!!!!"'0lB@O:(B $B$N%;%-%e%j%F%#99?7%b%8%e!<%k"'(B
$B!!!!!!!!(Bhttp://www.justsystems.com/jp/info/pd7004.html?m=jui31c01
$B(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(B

$B!!!ZA[Dj$5$l$k0-1F6A![(B
$B!!!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D(B
$B!!0-0U$N$"$kBh;0    ($B8eN,(B)
  

$B!!(B$B0lB@O:$N@H ($B%8%c%9%H%7%9%F%`(B) $B$b2~D{$5$l$F$*$j!"0lB@O:(B 2004 / 13 / 12 / 11 $B$K$D$$$F$b=$@5%W%m%0%i%`$,MQ0U$5$l$F$$$k!#(B

$B"#(B $B$$$m$$$m(B (2007.10.31)
(various)


$B"#(B 2007.10.30

$B"#(B $B$$$m$$$m(B (2007.10.30)
(various)

2007.11.09 $BDI5-(B:

$B!!(BSonicStage Ver.4.0$B0J9_$r$4;HMQ$N$*5RMM$X=EMW$J$*CN$i$;(B (SONY, 2007.11.06)$B!#(BCONNECT Player $B$N7o(B$B$H;W$o$l!#(B

2007.12.04 $BDI5-(B:

$B!!(BSonicStage $B$N7o!"=$@5%W%m%0%i%`$,8x3+$5$l$^$7$?(B: SonicStage CP$B!J(BSonicStage Ver.4.0/4.1/4.2/4.3$B!K(B $B%;%-%e%j%F%#@H (SONY)$B!#(B $BF?L>4uK>$5$s>pJs$"$j$,$H$&$4$6$$$^$9!#(B

$B!!4XO"(B: JVN#66291445 - SonicStage CP $B$K$*$1$k%P%C%U%!%*!<%P!<%U%m!<$N@H

$B"#(B $BDI5-(B

Double Whammy! Another Sony Case (And it's Not BioShock) (SONY $B%]%1%C%H%S%C%H$M$?(B)

$B!!:F%$%s%9%H!<%kMQ%=%U%H%&%'%"0l<0$,8x3+$5$l$F$$$^$9!#(B

Windows Update$B$r$3$C$=$j99?7!)!!!V%^%k%&%'%"!W8F$P$o$j$K(BMS$B$,

$B!!$$$$$o$1(B: $B!V%a%s%F$KHQ$o$5$l$?$/$J$$?M8~$1!W!"(BOneCare$B$N@_DjJQ99LdBj$G(BMS$B$, (ITmedia, 2007.10.29)

$B"#(B RealNetworks, Inc.$B!"%;%-%e%j%F%#@H
(RealNetworks, 2007.10.25)

$B!!(BRealPlayer 10.5 $B0JA0!"(BMac $BMQ(B RealPlayer 10.1 $B0JA0!"(BLinux $BMQ(B RealPlayer 10.0.8 $B0JA0!"(BHelix Player 10.0.8 $B0JA0$KJ#?t$N7g4Y!#96N,(B mp3 / rm / SMIL / swf / ram / pls $B%U%!%$%k$K$h$C$FG$0U$N%3!<%I$,CVE-2007-5080 CVE-2007-5081 CVE-2007-3410 CVE-2007-2263 CVE-2007-2264 CVE-2007-4599

$B!!(BRealPlayer 11 / 10.5 (6.0.12.1662)$B!"(B Mac $BMQ(B RealPlayer 10.0.0.503$B!"(BLinux $BMQ(B RealPlayer 10.0.9$B!"(BHelix Player 10.0.9 $B$G=$@5$5$l$F$$$k!#$J$*!":#(B RealPlayer 10.5 $B$r%@%&%s%m!<%I$7$?$j!"(BRealPlayer $B$r5/F0$7$F!V%"%C%W%G!<%H$r%A%'%C%/!W$7$?$j$9$k$H(B 6.0.12.1665 $B$K$J$k$h$&$@!#(B

2007.12.25 $BDI5-(B:

$B!!$3$N7g4Y$r96N,$9$k(B Web $B%Z!<%8$,EP>l$7$F$$$k$h$&$G$9!#(B

$B!!$J$*!"$5$-$[$I(B RealPlayer 11 $B$K%"%C%W%0%l!<%I$7$F$_$?$i!"%S%k%IHV9f$O(B 6.0.14.748 $B$G$7$?!#(B


$B"#(B 2007.10.29

$B"#(B [SECURITY] Fedora Core 6 Update: openssh-4.3p2-25.fc6
(RedHat, 2007.10.15)

$B!!(BFedora Core 6 $B$N(B openssh $B%Q%C%1!<%8$K7g4Y!#(BFedora Core 6 $B$G$NFH<+3HD%ItJ,(B (openssh-4.3p1-audit.patch) $B$K7g4Y$,$"$j!":Y9)$7$?%f!<%6L>$rMQ$$$F(B audit log $B$KG$0U$NJ8;zNs$rA^F~$G$-$k!#(B CVE-2007-3102

$B!!(Bopenssh-4.3p2-25.fc6 $B$G=$@5$5$l$F$$$k!#F1$8LdBj$O(B RHEL / CentOS 5 $B$N(B openssh $B%Q%C%1!<%8$K$b$"$k$h$&$J5$$,!#(B

2007.11.09 $BDI5-(B:

$B!!(BRHEL 5 fix $B=P$^$7$?(B: RHSA-2007:0540-3 - Moderate: openssh security and bug fix update

$B"#(B $B$$$m$$$m(B (2007.10.29)
(various)

$B"#(B $BDI5-(B

JVN#50495547 / JVN#32981509 / JVN#29211062: $B!V0lB@O:%7%j!<%:!W$K$*$1$k(B3$B$D$N%P%C%U%!%*!<%P!<%U%m!<$N@H

$B!!4XO"(B:

$B!!$$$:$l$b%j%C%A%F%-%9%H%U%!%$%k$N=hM}$K$*$1$k(B buffer overflow $B7g4Y!#(B

  • {\header \pard} $B%U%#!<%k%I$K$*$$$F!"(Bpard $B$rD9$$J8;zNs$r;XDj$9$k$H(B buffer overflow
  • fcharset0 $B%U%#!<%k%I$KD9$$%U%)%s%HL>$r;XDj$9$k$H(B buffer overflow
  • {\info{\title $B%U%#!<%k%I$KD9$$%?%$%H%kL>$r;XDj$9$k$H(B buffer overflow
RealPlayer Exploit On The Loose

$B!!>e5-(B patch $B$G$O!"(BMPAMedia.dll $B$N7g4Y$b=$@5$5$l$F$$$?LOMM(B:


$B"#(B 2007.10.28

$B"#(B $B$O$F$J$N(BCAPTCHA$B$O4JC1$KGK$l$k(B
($BFd@%(B Blog, 2007.10.26)

$B!!(B0-day $B$G$9$+!#@$$NCf%-%S%7%$!#(B

$B0J>e$G$O$F$J$N(BCAPTCHA$B$rGK$k$3$H$,$G$-$?$o$1$G$9$,!"%]%$%s%H$O0J2<$N#4$D!#(B

$B"#(B $BDI5-(B

$BFCDj$N%$%s%F%k%W%m%;%C%5$rEk:\$9$k%G%9%/%H%C%W@=IJ$N%7%9%F%`(BBIOS$B$r%"%C%W%G!<%H$7$F$/$@$5$$!J2~HG!K(B

$B!!(BMicrosoft $B$+$i$b(B microcode reliability update $B$,=P$F$$$^$7$?!#(B

0day: PDF pwns Windows

$B!!4XO"(B:

  • PDF$B%U%!%$%k%"%?%C%/$NF|K\>eN&$r3NG'(B ($B%H%l%s%I%^%$%/%m(B $B%;%-%e%j%F%#(B blog, 2007.10.27)$B!#

    $B!!8=:_!"(BPDF$B%U%!%$%k%"%?%C%/$K$F3NG'$5$l$F$$$k%a!<%k7oL>$O

    • Balance Report
    • Credit report
    • Personal Balance Report
    • Personal Credit report
    • Personal Financial Statement
    • tax statement
    • Your Credit points
    • Your Credit report
    • Your Credit File

    $B


$B"#(B 2007.10.27

$B"#(B $BDI5-(B

$B=i2;%_%/$G%0!<%0%kH,J,!)(B

$B!!(B$B%d%U! (ITmedia, 2007.10.26)


$B"#(B 2007.10.26

$B"#(B $BDI5-(B

0day: PDF pwns Windows

$B!!4XO"(B:

Windows Update$B$r$3$C$=$j99?7!)!!!V%^%k%&%'%"!W8F$P$o$j$K(BMS$B$,

$B!!(BWindows Live OneCare $B$rF~$l$k$H$3$C$=$jJQ$($i$l$F$7$^$&;v

$B%"%i!<%H(B/$B%"%I%P%$%6%j!'%&%$%k%98!:w%(%s%8%s(B VSAPI 8.320.1004 $B$*$h$S(B 8.500.1002 $B$N%U%#%k%?%I%i%$%P(BTmxpflt.sys $B$K$*$1$k%P%C%U%!%*!<%P%U%m!<$N@H

$B!!4XO"(B:


$B"#(B 2007.10.25

$B"#(B JVN#50495547 / JVN#32981509 / JVN#29211062: $B!V0lB@O:%7%j!<%:!W$K$*$1$k(B3$B$D$N%P%C%U%!%*!<%P!<%U%m!<$N@H
(IPA, 2007.10.25)

$B!!0lB@O:(B 2007 / 2006 / 2005 / $BJ8i:(B / 2004 / 13 / 12 / 11 / Lite2$B!"0lB@O:(B for Linux$B!"0lB@O:%S%e!<%"$K(B 3 $B

$B!!0lB@O:(B 2007 / 2006 / 2005 / $BJ8i:(B / Lite2$B!"0lB@O:(B for Linux$B!"0lB@O:%S%e!<%"$K$O=$@5%W%m%0%i%`$,MQ0U$5$l$F$$$k!#(B$B0lB@O:$N@H ($B%8%c%9%H%7%9%F%`(B) $B$+$i%@%&%s%m!<%I$7$FE,MQ$9$l$P$h$$!#(B $B$=$NB>$K$D$$$F$O$b$O$d%a%s%F%J%s%9$5$l$F$$$J$$$?$a!"$^$:$O%a%s%F%J%s%9$5$l$F$$$k%P!<%8%g%s$K%"%C%W%0%l!<%I$7!"$=$N8e$G=$@5%W%m%0%i%`$rE,MQ$9$k!#(B

2007.10.29 $BDI5-(B:

$B!!4XO"(B:

$B!!$$$:$l$b%j%C%A%F%-%9%H%U%!%$%k$N=hM}$K$*$1$k(B buffer overflow $B7g4Y!#(B

2007.10.31 $BDI5-(B:

$B!!(B$B0lB@O:(Bplug-in$B$r(BIE$B$H(BFirefox$B$GL58z$K(B $B!A(B $B%8%c%9%H%7%9%F%`$OK\Ev$N6<0R$r65$($F$/$l$J$$(B ($B9bLZ9@8w!w<+Bp$NF|5-(B, 2007.10.30)$B!#(B $B8D?ME*$K$O!"%8%c%9%H%7%9%F%`$O$b$O$dC1$J$k%"%W%j%1!<%7%g%s%Y%s%@!<$G$O$J$/!"%"%s%A%&%$%k%9%=%U%H$r07$&%;%-%e%j%F%#%Y%s%@!<$H$J$C$?$K$b$+$+$o$i$:!"$3$&$$$&BVEY$@$H$$$&E@$,0lHV$NLdBj$@$H;W$&!#(B

$B!!JS$BJ8=q%S%e!<%"(B ActiveX$B%W%i%0%$%s(B ($B%8%c%9%H%7%9%F%`(B) $B$b%$%s%9%H!<%k$7$F$_$?$N$@$1$I!"(B $B%W%i%0%$%s$,$^$H$b$KF0:n$7$F$$$J$$$h$&$J$N$@$h$J$"!#$&!<$s!#4n$s$G$$$$$N$d$iHa$7$`$Y$-$J$N$d$i!#(B

$B!!!D!D$5$-$[$I!V%8%c%9%H%7%9%F%`!!%f!<%6!<%:!&%$%s%U%)%a!<%7%g%s!W(B $B$,N.$l$F$-$?!#(B

Date: Wed, 31 Oct 2007 13:57:04 +0900
To: users-information@justsystem.co.jp
From: Justsystem <users@justsystem.co.jp>
Subject: UsersInfo$B!Z0lB@O:$N!V%;%-%e%j%F%#99?7%b%8%e!<%k!W8x3+$N$*CN$i$;![(B10/31
($BCfN,(B)
$B(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(B
$B!!!!!!!!!!!!!!"'0lB@O:(B $B$N%;%-%e%j%F%#99?7%b%8%e!<%k"'(B
$B!!!!!!!!(Bhttp://www.justsystems.com/jp/info/pd7004.html?m=jui31c01
$B(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(!(B

$B!!!ZA[Dj$5$l$k0-1F6A![(B
$B!!!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D!D(B
$B!!0-0U$N$"$kBh;0
($B8eN,(B)

$B!!(B$B0lB@O:$N@H ($B%8%c%9%H%7%9%F%`(B) $B$b2~D{$5$l$F$*$j!"0lB@O:(B 2004 / 13 / 12 / 11 $B$K$D$$$F$b=$@5%W%m%0%i%`$,MQ0U$5$l$F$$$k!#(B

$B"#(B $B$$$m$$$m(B (2007.10.25)
(various)

$B"#(B ($BB.Js(B) L.root-servers.net $B$N(B IP $B%"%I%l%9JQ99$K$D$$$F(B
(JPRS, 2007.10.24)

$B!!(BDNS $B$N%k!<%H%5!<%P$N(B 1 $B$D!"(BL $B%k!<%H%5!<%P$N(B IPv4 $B%"%I%l%9$,!"(B198.32.64.12 $B$+$i(B 199.7.83.42 $B$KJQ99$5$l$k$=$&$G$9!#$3$NJQ99$O(B 2007.11.01 $B$K9T$o$l$^$9!#(B $B5l%"%I%l%9$b!">/$J$/$H$b(B 6 $B$+7n$O0];}$5$l$k$=$&$G$9!#(B2007.11.01 $B0J9_$K!"K:$l$:$KBP1~$7$F$*$-$^$7$g$&!#(B


$B"#(B 2007.10.24

$B"#(B 103112: Vulnerability in Java Runtime Environment Virtual Machine May Allow Untrusted Application or Applet to Elevate Privileges
(Sun, 2007.10.22)

$B!!(BSun Java JDK / SDK / JRE $B$K7g4Y!#?.Mj$5$l$F$$$J$$%"%W%l%C%H$K$h$k8"8B>e>:$,2DG=!#(Blocal file $B$NFI$_=q$-$d(B local $B%"%W%j$N

$B!!0J2<$N%P!<%8%g%s$G=$@5$5$l$F$$$k(B:

$B"#(B $BDI5-(B

0day: PDF pwns Windows

$B!!$5$C$=$/%&%$%k%9$,EP>l$7$F$$$k$h$&$G$9!#(B

$B=i2;%_%/$G%0!<%0%kH,J,!)(B

$B!!8=:_$N>u67(B

  • Google: $BYahoo! Japan: $BI=<($5$l$k$h$&$K$J$C$F$-$?$,!"(BMicrosoft Live Search $B$HHf$Y$k$H$+$J$jNt$k(B

$B!!4XO"(B:


$B"#(B 2007.10.23

$B"#(B Drupal 4.7.8 and 5.3 released: Security updates and bugfixes.
(drupal.org, 2007.10.17)

$B!!(BDrupal 4.7.8 / 5.3 $B$K$*$$$F!"(B5 $BpJs$"$j$,$H$&$4$6$$$^$9!#(B

$B!!$3$NB>$K!"(Bdrupal $BMQ$N%b%8%e!<%k$N7g4Y>pJs$,8x3+$5$l$F$$$^$9!#(B

$B!!$^$?!"(BPHP $B$N7g4Y$K4X$9$k>pJs$,8x3+$5$l$F$$$^$9!#(B

$B"#(B $BDI5-(B

Macrovision secdrv.sys Local Privilege Escalation

$B!!4XO"(B:

Patch available for PageMaker buffer overflow vulnerability

$B!!F|K\8lHG(B: APSB07-15: PageMaker$B$K$*$1$k%P%C%U%!%*!<%P!<%U%m!<$N@H (Adobe)

Illustrator CS3 update to address potential security vulnerabilities

$B!!F|K\8lHG(B: APSB07-16: Illustrator CS3$B$N@x:_E*$J@H (Adobe)

GoLive 9 update to address potential security vulnerabilities

$B!!F|K\8lHG(B: APSB07-17: GoLive 9$B$N@x:_E*$J@H (Adobe)

Web Page Code Injection via ARP Spoofing

$B!!(BARP$B%9%W!<%U%#%s%0!'FI ($BF|7P(B IT Pro, 2007.10.19)$B!#(B ARP Spoofing: Is Your Web Hosting Service Protected ? $B$NK]Lu5-;v!#(B

0day: PDF pwns Windows

$B!!(BAdobe Reader 8.x, Acrobat 8.x $BMQ$N=$@5%W%m%0%i%`$,8x3+$5$l$?!#(B

$B!!$7$+$7(B Adobe Reader 7.x, Acrobat 7.x $BMQ$N=$@5%W%m%0%i%`$O$^$@8x3+$5$l$F$$$J$$!#4XO"(B:

$B=i2;%_%/$G%0!<%0%kH,J,!)(B

$B!!8=:_$N>u67(B

  • Google: $B$"$$$+$o$i$:I=<($5$l$J$$(B
  • Yahoo! Japan: $BI=<($5$l$k$h$&$K$J$C$F$-$?!#$7$+$7(B Microsoft Live Search $B$h$j$O$+$J$jNt$k(B

$B!!4XO"(B:


$B"#(B 2007.10.22


$B"#(B 2007.10.21


$B"#(B 2007.10.20

$B"#(B (Currently unpatched) iPhone vulnerability with exploit
(SANS ISC, 2007.10.19)

$B!!(BiPhone / iPod touch 1.1.1 $B$K7g4Y!#(B libtiff $B$K7g4Y$,$"$j!"96N,(B TIFF $B2hA|$r;H$C$F(B iPhone / iPod touch $B$N%k!<%H%Q!<%F%#%7%g%s$N(B read/write $B8"8B$rCVE-2007-5450$B!#4XO"(B:

2007.11.13 $BDI5-(B:

$B!!$3$N7o$N=$@5$H;W$o$l(B: About the security content of iPhone v1.1.2 and iPod Touch v1.1.2 Updates (Apple)

$B"#(B $BDI5-(B

$B%^%$%/%m%=%U%H(B $B%;%-%e%j%F%#>pJs$N;vA0DLCN(B - 2007 $BG/(B 10 $B7n(B

$B!!(BMS07-060 $B$r96N,$9$k!"(BWindows $BMQ$N%&%$%k%9$,B8:_$9$kLOMM(B:

$B"#(B RealPlayer Exploit On The Loose
(Symantec blog, 2007.10.19)

$B!!(BWindows $BHG$N(B RealPlayer 10.5 $B0JA0$*$h$S(B 11 Beta $B$K(B 0-day $B7g4Y!#(B ActiveX $B%3%s%H%m!<%k(B ierpplug.dll $B$K(B buffer overflow $B$9$k7g4Y$,$"$j!"(B $B96N,(B Web $B%Z!<%8$K$h$C$FG$0U$N%3!<%I$r

$B!!(BRealPlayer 10.5 $B$*$h$S(B 11 Beta $B$KE,MQ$G$-$k(B patch $B$,8x3+$5$l$?(B: RealPlayer Security Vulnerability (Real.com)$B!#(B RealPlayer 10.0 $B0JA0$K$D$$$F$O!"0lC6(B 10.5 $B0J9_$K%"%C%W%0%l!<%I$7!"$=$N>e$G(B patch $B$rE,MQ$9$k!#(Bpatch $B$O(B RealPlayer $B<+?H$N%"%C%W%G!<%H5!G=$G$OE,MQ$G$-$J$$$N$GCm0U!#4XO"(B:

2007.10.29 $BDI5-(B:

$B!!>e5-(B patch $B$G$O!"(BMPAMedia.dll $B$N7g4Y$b=$@5$5$l$F$$$?LOMM(B:


$B"#(B 2007.10.19

$B"#(B $BDI5-(B

Citrix$B$,73$d@/I\$N(BWeb$B%5%$%H$rL5KIHw$K!=!=8&5f

$B!!4XO"(B:

$B%^%$%/%m%=%U%H(B $B%;%-%e%j%F%#>pJs$N;vA0DLCN(B - 2007 $BG/(B 8 $B7n(B

$B!!(BMS07-043 $B$K4XO"$9$k(B KB $B$,(B: You experience application performance issues after you install the update from security bulletin MS07-043 on a computer that is running Windows Server 2003 or Windows XP Professional x64 Edition (Microsoft KB943172)$B!#(BMS07-043 $B$rE,MQ$7$?(B 64bit $BHG$N(B Windows Server 2003 / XP $B$K$*$$$F!"(BOleaut32.dll $B$^$?$O(B Asycfilt.dll $B$r;HMQ$9$k%"%W%j%1!<%7%g%s$G%Q%U%)!<%^%s%9$NLdBj$,H/@8$9$kLOMM!#(B $B3:Ev$9$k%"%W%j%1!<%7%g%sNc$O(B Microsoft SQL Server Analysis Services $B$@$=$&$G!#(B $BM-=~(B patch $B$,$"$k$=$&$G$9!#(B

$B%^%$%/%m%=%U%H(B $B%;%-%e%j%F%#(B $B%"%I%P%$%6%j(B (943521) Windows Internet Explorer 7 $B$,%$%s%9%H!<%k$5$l$?(B Windows XP $B$*$h$S(B Windows Server 2003 $B$N(B URL $B$N=hM}$N@H

$B!!(BOpera, Firefox $B$N99?7$,Ajl!#$$$:$l$K$b!"$3$N7g4Y$X$NBP1~$,4^$^$l$F$$$k!#(B

$B!!4XO"(B:

JVN#71872818: AirStation WZR-RS-G54 $B$*$h$S(B AirStation WZR-RS-G54HP $B$K$*$1$k%/%m%9%5%$%H%j%/%(%9%H%U%)!<%8%'%j$N@H

$B!!(BWZR-RS-G54 / WZR-RS-G54HP $B$K2C$(!"(BWHR2-G54V $B$H(B BHR-4RV $B$K$b(B CSRF $B@HWZR-RS-G54HP$B!"(BWZR-RS-G54$B!"(BWHR2-G54V$B!"(BBHR-4RV$B@=IJ$K$*$1$k(B $B%/%m%9%5%$%H%j%/%(%9%H%U%)!<%8%'%j$N@H ($B%P%C%U%!%m!<(B, 2007.10.15)$B!#(B $B$$$:$l$b(B 2007.03.01 $BIU$G8x3+$5$l$F$$$?$N$G$9$M!#(B

$B=i2;%_%/$G%0!<%0%kH,J,!)(B

$B!!(BGoogle $B$N;vNc$O!"CY$/$H$b(B 9/25 $B$K$O$3$N>u67$K$J$C$F$$$?LOMM!#(B

  • $BK\F|$N=i2;%_%/(B ($BELA3F|5-(B, 2007.09.25)
    $B$=$N#4!'=i2;%_%/$r$0$0$C$F$_$?!#(B $B8!:w%H%C%W$O%/%j%W%H%s$J$N$O;j6KEvA3$GNI$$$N$G$9$,2hA|$r8+$k$H(B ($B2hA|(B) $B$,=P$F$/$k$N$O2?8N$@!*!*$A$J$_$KB?J,%G%b%s%Y%$%s$5$s$G$9!#0lJ8;z$b$"$C$F$M$'$8$c$M$'$+!#(B

$B!!$^$?!"(BJAN $B%3!<%I(B (4511820072413) $B$G2hA|8!:w$7$F$b$d$C$Q$j$R$C$+$+$i$J$$LOMM!#(B

$B!!$"$H!"8eH/@=IJ$N(B VOCALOID2 SWEET ANN ($B%/%j%W%H%s!&%U%e!<%A%c!#1236190 (slashdot.jp)$B!#(B $B$d$O$j0U?^E*$KMn$H$7$F$$$k$H$7$+9M$($i$l$J$$LOMM!#(B

$B!!4XO"(B:

$B"#(B Firefox 2.0.0.8 $B%j%j!<%9%N!<%H(B
(mozilla-japan.org, 2007.10.19)

$B!!(BFirefox 2.0.0.8 $BEP>l!#(B8 $B!"(BMac OS X 10.5 $B$X$NBP1~(B ($B$?$@$74{CN$NLdBj$"$j(B) $B$,$J$5$l$F$$$k!#(B $B=$@5$5$l$?7g4Y$N$&$A!"(BMFSA2007-36: $BIT@5$K(B % $B%(%s%3!<%I$5$l$?(B URI $B$,(B Windows $B$K$h$C$F8m$C$F=hM}$5$l$k(B $B$O!"(B$B%^%$%/%m%=%U%H(B $B%;%-%e%j%F%#(B $B%"%I%P%$%6%j(B (943521) Windows Internet Explorer 7 $B$,%$%s%9%H!<%k$5$l$?(B Windows XP $B$*$h$S(B Windows Server 2003 $B$N(B URL $B$N=hM}$N@H $B$NOC$@$m$&!#(B

$B=EMWEY(B: $B4m5!E*(B
$B=EMWEY(B: $B9b(B
$B3:Ev$J$7!#(B
$B=EMWEY(B: $BCf(B
$B=EMWEY(B: $BDc(B

$B"#(B $B%"%i!<%H(B/$B%"%I%P%$%6%j!'%&%$%k%98!:w%(%s%8%s(B VSAPI 8.320.1004 $B$*$h$S(B 8.500.1002 $B$N%U%#%k%?%I%i%$%P(BTmxpflt.sys $B$K$*$1$k%P%C%U%!%*!<%P%U%m!<$N@H
($B%H%l%s%I%^%$%/%m(B, 2007.10.18)

$B!!%H%l%s%I%^%$%/%m$N%&%$%k%98!:w%(%s%8%s(B VSAPI 8.320.1004, 8.500.1002 $B$KIUB0$9$k%U%#%k%?%I%i%$%P(B Tmxpflt.sys $B$K(B buffer overflow $B$9$k7g4Y$,$"$j!"(Blocal user $B$,%7%9%F%`8"8B$GG$0U$N%3!<%I$rCVE-2007-4277

$B!!(B$B%&%$%k%98!:w%(%s%8%s(B VSAPI 8.550-1001 $B$G=$@5$5$l$k!#8=:_$O(B Web $B%Z!<%8>e(B$B$G$N$_8x3+$5$l$F$*$j!"(B2007.10.24 $B$K(B ActiveUpdate $B$G$b8x3+$5$l$k!#(B VSAPI 8.550 $B$O!"(B$B%j%j!<%9%N!<%H(B$B$N%Z!<%8$K$O$^$@7G:\$5$l$F$$$^$;$s$M!D!D!#(B

2007.10.26 $BDI5-(B:

$B!!4XO"(B:

$B"#(B Macrovision secdrv.sys Local Privilege Escalation
(eEye research, 2007.10.16)

$B!!(BWindows XP / Server 2003 $B$KI8=`Ec:\$5$l$F$$$k(B Macrovision $B@=$N%G%P%$%9%I%i%$%P(B secdrv.sys $B$K7g4Y$,$"$j!"(Blocal user $B$,(B Ring0 ($B%+!<%M%k%l%Y%k(B) $BFC8"(B$B$rWindows$B$NL$CN$N@H (ITmedia, 2007.10.18) $B$N7o$H;W$o$l!#(B%WINDIR%\system32\drivers\secdrv.sys $B$+$J!#(B CVE-2007-5586

$B!!(Bpatch $B$O$^$@$J$$!#(B

2007.10.23 $BDI5-(B:

$B!!4XO"(B:

2007.11.06 $BDI5-(B:

$B!!4XO"(B:

2007.11.07 $BDI5-(B:

$B!!(Bpatch $BEP>l!#(B

$B!!4XO"(B:

2007.12.12 $BDI5-(B:

$B!!(BMS07-067 - $B=EMW!!(B Macrovision $B%I%i%$%P$N@H:3J$5$l$k(B (944653) $B$G$b=$@5$5$l$?!#(B


$B"#(B 2007.10.18

$B"#(B $B=i2;%_%/$G%0!<%0%kH,J,!)(B
($B0-FA>&K!!)%^%K%"%C%/%9(B $B%3%3%m%0;YE9(B, 2007.10.18)

$B!!%M%?$b$H(B: $B!Z05NO!)![!V=i2;%_%/!W$G%$%a!<%88!:w$+$1$F$b%R%C%H$;$:!#$5$i$K(Bwikipedia$B$+$i$b:o=|!Z(BTBS$B!)![(B ($B">"^"?(I!$B'%(I!(B)$B"?%+%8B."a"a"a">"^$D(I_$B'%(I_(B)$B$D(BFull Auto, 2007.10.18)$B!#(B Google $B$d(B Yahoo! Japan $B$N2hA|8!:w$G!V=i2;%_%/!W$r$0$0$C$F$_$k$H!D!D!#(B $B$$$d$O$d!"$3$l$O$R$I$$!#(B

18 $B!'0J2L5$7$K$+$o$j$^$7$F(BVIP$B$,$*Aw$j$7$^$9!#(B $B!'(B2007/10/18($BLZ(B) 01:30:15.72 ID:fJNe75DB0
$BD`$j$+$H;W$C$?$i%^%8$@#w#w#w(B
$B$A$g$C$H$3$($((B

$B!!3F<+!"

$B!!%&%#%-%Z%G%#%"$K$D$$$F$O$3$A$i$r!#(B

2007.10.19 $BDI5-(B:

$B!!(BGoogle $B$N;vNc$O!"CY$/$H$b(B 9/25 $B$K$O$3$N>u67$K$J$C$F$$$?LOMM!#(B

$B!!$^$?!"(BJAN $B%3!<%I(B (4511820072413) $B$G2hA|8!:w$7$F$b$d$C$Q$j$R$C$+$+$i$J$$LOMM!#(B

$B!!$"$H!"8eH/@=IJ$N(B VOCALOID2 SWEET ANN ($B%/%j%W%H%s!&%U%e!<%A%c!#1236190 (slashdot.jp)$B!#(B $B$d$O$j0U?^E*$KMn$H$7$F$$$k$H$7$+9M$($i$l$J$$LOMM!#(B

$B!!4XO"(B:

2007.10.23 $BDI5-(B:

$B!!8=:_$N>u67(B

$B!!4XO"(B:

2007.10.24 $BDI5-(B:

$B!!8=:_$N>u67(B

$B!!4XO"(B:

2007.10.27 $BDI5-(B:

$B!!(B$B%d%U! (ITmedia, 2007.10.26)

$B"#(B Opera 9.24 $BEP>l(B
(Opera, 2007.10.18)

$B!!(BOpera 9.24 $BEP>l!#(B2 $B

$B"#(B $BDI5-(B

$B$$$m$$$m(B (2007.09.28)

$B!!(BAIM $B$N7o!"=$@5$5$l$?LOMM(B: AIM$B?7HG!"?<9o$J@H (ITmedia, 2007.10.16)


$B"#(B 2007.10.17

$B"#(B $BDI5-(B

$B%^%$%/%m%=%U%H(B $B%;%-%e%j%F%#(B $B%"%I%P%$%6%j(B (943521) Windows Internet Explorer 7 $B$,%$%s%9%H!<%k$5$l$?(B Windows XP $B$*$h$S(B Windows Server 2003 $B$N(B URL $B$N=hM}$N@H

$B!!4XO"(B:

Protecting Browsers from DNS Rebinding Attacks

$B!!DI2C(B: Sun Java VM: CVE-2007-5375

$B"#(B Norton 360$B$K$h$j(BEFS$B$N0E9f2=$,;\$5$l$?%U%!%$%k$,GK2u$5$l$kLdBj(B
(Narusase$B$NF|5-(B -$B%O%K%]$C$F$I$&$h!)(B($B2>(B)-, 2007.10.16)

$B!!(BNorton 360 $B$r$*;}$A$NJ}!"$<$RDI;n$r!#(B

$B"#(B $B$$$m$$$m(B (2007.10.17)
(various)

2007.12.09 $BDI5-(B:

$B!!(BBrightStor ARCserve Backup Security Notice (CA) $B$@$,!"(B $B>/$J$/$H$b(B CVE-2007-5327 $B$,$C$F$$$J$+$C$?LOMM$G!"?7$7$$(B patch $B$,8x3+$5$l$F$$$k!#(B $B4XO"(B: [UPDATE] CA BrightStor ARCServe BackUp Message Engine Remote Stack Overflow Vulnerability (cocoruder)


$B"#(B 2007.10.16

$B"#(B $BDI5-(B

$B%^%$%/%m%=%U%H(B $B%;%-%e%j%F%#(B $B%"%I%P%$%6%j(B (943521) Windows Internet Explorer 7 $B$,%$%s%9%H!<%k$5$l$?(B Windows XP $B$*$h$S(B Windows Server 2003 $B$N(B URL $B$N=hM}$N@H

$B!!(B3rd party patch $B$@$=$&$G$9(B: Third-party patch for CVE-2007-3896 (Internet Explorer 7 invalid URI handling) available

The patch consists of a ShellExecuteEx hook [2] that prevents the execution of malformed URLs and enforces normalization of valid URLs.

$B!!$"$H!"(BISS $B$N>pJs(B: $BJ#?t$N%Y%s%@!<@=IJ$G$N(B URI $B=hM}$K$h$k%3%^%s%I$N (ISSKK, 2007.10.15)

$B"#(B $B$$$m$$$m(B (2007.10.16)
(various)


$B"#(B 2007.10.15


$B"#(B 2007.10.14

$B"#(B Fortify Software Identifies and Protects Against New Class of Vulnerabilities $B!=(B Cross-Build Injection $B!=(B Tied To Open Source Software
(Fortify, 2007.10.09)

$B!!%=!<%9$+$iJava Open Review Project (fortifysoftware.com) $B$H$$$&$b$N$,$"$k$=$&$G!#(B

$B!!(BCommon Weakness Enumeration (CWE) (mitre.org) $B$H$$$&$b$N$,$"$k$N$G$9$M!#CN$i$J$+$C$?!D!D(B


$B"#(B 2007.10.13

$B"#(B OpenSSL Security Advisory [12-Oct-2007]
(OpenSSL.org, 2007.10.12)

$B!!(BOpenSSL $B$K(B 2 $B$D$N7g4Y!#(B

$B!!(BOpenSSL 0.9.8f / 0.9.7m $B$G=$@5$5$l$F$$$k!#$^$?!"(BOpenSSL 0.9.8f $B$r;H$C$?(B DTLS $B%/%i%$%"%s%H$O(B OpenSSL 0.9.8e $B0JA0$r;H$C$?(B DTLS $B%5!<%P$H$ODL?.$G$-$J$$!#(B Changes between 0.9.8e and 0.9.8f [11 Oct 2007] $B$r;2>H!#(B

$B!!8M0f$5$s>pJs$"$j$,$H$&$4$6$$$^$9!#(B

$B"#(B $BDI5-(B

Web Page Code Injection via ARP Spoofing

$B!!(BNod to more ARP mayhem ? (McAfee blog, 2007.10.11)$B!#(BNOD32 $B$G$*$J$8$_(B ESET $B$NCf9q%5%$%H$b$3$l$G%d%i%l$?$h$&$G!#(B


$B"#(B 2007.10.12

$B"#(B 2007$BG/(B10$B7n(B10$BF|0J9_$K%@%&%s%m!<%I$7$?%$%s%?!<%M%C%H%A%c%s%M%k$O!"$I$3$,JQ$o$C$F$$$k$N$G$9$+!)(B
(Wii $B%5%]!<%H>pJs(B, 2007.10.10)

Opera$B%V%i%&%6$N%P!<%8%g%sHV9f$,!"(B9.1$B$+$i(B9.3$B$K$J$j$^$7$?!#(B
($BCfN,(B)
Flash Player$B$H(BJavaScript$B$K4X$9$k@H

$B!!(BFlash Player $B$N%P!<%8%g%sHV9f$O$$$/$D$K$J$C$F$$$k$N$@$m$&!#(B

$B!!4XO"(B: Wii$B%$%s%?!<%M%C%H%A%c%s%M%k!&%"%I%l%956Au$N%;%-%e%j%F%#=$@5(B? ($B?eL57n$P$1$i$N$($SF|5-(B, 2007.10.12)

$B"#(B JVN#63304072: MouseoverDictionary $B$K$*$$$FG$0U$N%9%/%j%W%H$,
(JVN, 2007.10.12)

$B!!(BMouseover Dictionary $B$K!"G$0U$N%9%/%j%W%H$,CVE-2007-5459

$B"#(B JVN#71872818: AirStation WZR-RS-G54 $B$*$h$S(B AirStation WZR-RS-G54HP $B$K$*$1$k%/%m%9%5%$%H%j%/%(%9%H%U%)!<%8%'%j$N@H
(JVN, 2007.10.12)

$B!!%P%C%U%!%m!<(B AirStation WZR-RS-G54 / WZR-RS-G54HP $B$N4IM}(B Web $B%Z!<%8$K(B CSRF $B@H

2007.10.19 $BDI5-(B:

$B!!(BWZR-RS-G54 / WZR-RS-G54HP $B$K2C$(!"(BWHR2-G54V $B$H(B BHR-4RV $B$K$b(B CSRF $B@HWZR-RS-G54HP$B!"(BWZR-RS-G54$B!"(BWHR2-G54V$B!"(BBHR-4RV$B@=IJ$K$*$1$k(B $B%/%m%9%5%$%H%j%/%(%9%H%U%)!<%8%'%j$N@H ($B%P%C%U%!%m!<(B, 2007.10.15)$B!#(B $B$$$:$l$b(B 2007.03.01 $BIU$G8x3+$5$l$F$$$?$N$G$9$M!#(B


$B"#(B 2007.10.11

$B"#(B $B%^%$%/%m%=%U%H(B $B%;%-%e%j%F%#(B $B%"%I%P%$%6%j(B (943521) Windows Internet Explorer 7 $B$,%$%s%9%H!<%k$5$l$?(B Windows XP $B$*$h$S(B Windows Server 2003 $B$N(B URL $B$N=hM}$N@H
(Microsoft, 2007.10.11)

$B!!!V(Bgnucitizen $B$N(B Petko Petkov $B;a!W$NL>A0$b5s$,$C$F$k$7!"(B0day: PDF pwns Windows $B$NOC$H4X78$"$k$N$+$J$"!#(BCVE-2007-3896

$B2?$,860x$G5/$3$j$^$9$+(B?
$B$3$N6<0R$O(B Windows $B$,(B Windows $B$KEO$5$l$?FCJL$J:Y9)$,$5$l$?(B URL $B$^$?$O(B URI $B$r@5$7$/=hM}$7$J$$>l9g$KH/@8$7$^$9!#(BInternet Explorer 7 $B$O(B Windows $B$N%3%s%]!<%M%s%H$r99?7$7$^$9!#$3$l$O(B URL $B$*$h$S(B URI $B$,=hM}$5$l$k;~!"(BInternet Explorer $B$H(B Windows $B%7%'%k4V$NBPOC$rJQ99$7$^$9!#M-8z$G$J$$(B URI $B$^$?$O(B URL $B$r(B Windows $B$KEO$9%"%W%j%1!<%7%g%s$K$h$j!"$3$N@H

$B!!0UL#$,$o$+$i$J$$$N$G1QJ8$rFI$s$G$_$k!#(B

What causes this threat?
The threat presents itself when Windows does not correctly handle specially crafted URLs or URIs that are passed to it. Internet Explorer 7 updates a Windows component, which modifies the interaction between Internet Explorer and Windows Shell when handling URLs and URI's. Applications which pass un-validated URIs or URLs to Windows can be leveraged to exploit this vulnerability.

$B!!$3$s$J46$8$+$J$"!#(B

$B$3$N6<0R$N860x$O(B?
$B$3$N6<0R$O!"FCJL$K:Y9)$5$l$?(B URL $B$d(B URI $B$,(B Windows $B$KEO$5$l!"$+$D@5$7$/=hM}$5$l$J$$>l9g$KH/8=$7$^$9!#(BInternet Explorer 7 $B$r%$%s%9%H!<%k$9$k$H(B Windows $B%3%s%]!<%M%s%H$,99?7$5$l!"(BURL $B$d(B URI $B$r=hM}$9$k:]$N(B Internet Explorer $B$H(B Windows Shell $B$H$N4V$N$d$j$H$j$,JQ99$5$l$^$9!#@5$7$$$HJ]>c$5$l$F$$$J$$(B URL $B$d(B URI $B$r(B Windows $B$KAw$k%"%W%j%1!<%7%g%s$O!"$3$N@H

$B!!!V(BURL $B$d(B URI $B$r=hM}$9$k:]$N(B Internet Explorer $B$H(B Windows Shell $B$H$N4V$N$d$j$H$j$,JQ99$5$l!W$k$N$@$1$I!"$=$NItJ,$,$@$a$@$a!"$H$$$&$3$H$J$s$G$9$+$M$(!#(B

$B!!(BAdditional Details and Background on Security Advisory 943521 (MSRC Blog, 2007.10.10) $B$K2r@b$,!#(B

In late July, another issue was discussed publicly using mailto: and 3rd party applications. This is the vulnerability discussed in the Advisory released today and it is a vulnerability in the way Windows handles URIs. This is not a vulnerability in any specific protocol handler, even though the mailto: protocol handler is used in our example. The examples we have seen involved the mailto: protocol handler being asked to handle URIs containing a % (percent sign). An example of this would be test%../../../../windows/system32/calc.exe$B!I(B.cmd, which is clearly not a valid email address. When a user clicks a link to a URI, the application showing that link to users decides how it is supposed to be handled. For traditionally $B!H(Bsafe$B!I(B protocols like mailto: or http: applications often just verify the prefix and then choose to call into the Windows shell32 function ShellExecute() to handle it. This has been the case for a number of years. Windows then launches Internet Explorer passing the URI or launches the preferred email client passing the email address, etc. With IE6 installed, ShellExecute() passes the URI to IE which accepts it and inside IE determines it to be invalid. Navigation then fails harmlessly. With Internet Explorer 7 installed, the flow is a bit different. IE7 began to do more validation up front to reject malformed URI's. When this malformed URI with a % was rejected by IE7, ShellExecute() tries to $B!H(Bfix up$B!I(B the URI to be usable. During this process, the URI is not safely handled. IE7 rejects the URI, and on Windows Vista ShellExecute() gracefully rejects the URI. That$B!G(Bs not the case on the older versions of Windows like Windows XP and Windows Server 2003 when IE7 is installed.

$B!!4XO"$+$J(B: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype $B0J2<$N%9%l%C%I!#(B

2007.10.16 $BDI5-(B:

$B!!(B3rd party patch $B$@$=$&$G$9(B: Third-party patch for CVE-2007-3896 (Internet Explorer 7 invalid URI handling) available

The patch consists of a ShellExecuteEx hook [2] that prevents the execution of malformed URLs and enforces normalization of valid URLs.

$B!!$"$H!"(BISS $B$N>pJs(B: $BJ#?t$N%Y%s%@!<@=IJ$G$N(B URI $B=hM}$K$h$k%3%^%s%I$N (ISSKK, 2007.10.15)

2007.10.17 $BDI5-(B:

$B!!4XO"(B:

2007.10.19 $BDI5-(B:

$B!!(BOpera, Firefox $B$N99?7$,Ajl!#$$$:$l$K$b!"$3$N7g4Y$X$NBP1~$,4^$^$l$F$$$kLOMM!#(B

$B!!4XO"(B:

2007.11.14 $BDI5-(B:

$B!!(BMS07-061$B!!(BWindows URI $B=hM}$N@H (Microsoft) $B$G=$@5$5$l$F$$$k!#(B

$B"#(B $BDI5-(B

Windows Media Player $B%W%i%0%$%s$N@H

$B!!(BKB911564 $B$K$3$s$J5-=R$,DI2C$5$l$?LOMM(B:

You may experience issues when you deploy security update MS06-006 on a computer that is running Microsoft Windows Sever 2003 Service Pack 2. Windows Update, Windows Server Update Services, Systems Management Server, and Microsoft Baseline Security Analyzer detection logic do not offer security update MS06-006 if the Microsoft Windows Media Player plug-in for a non-Microsoft Internet browser is installed on the computer. You can install security update MS06-006 manually.

$B!!(BWindows Server 2003 SP2 $B$K$*$$$F!"(BWindows Update / WSUS / SMS / MBSA $B$,(B MS06-006 $B$r(B ($B%$%s%9%H!<%k:Q$J$N$K(B) $B8!=P$7$J$$>l9g$O!"(BMS06-006 $B$r

$B%^%$%/%m%=%U%H(B $B%;%-%e%j%F%#>pJs$N;vA0DLCN(B - 2007 $BG/(B 10 $B7n(B

$B!!(BMS07-060 - $B6[5^(B: Microsoft Word $B$N@H $B$N!"(BOffice 2004 for Mac $BMQ$N(B exploit $B$,B8:_$9$kLOMM(B:

$B"#(B Kaspersky Web Scanner ActiveX Format String Vulnerability
(iDefense, 2007.10.10)

$B!!(BKaspersky Online Virus Scanner ($BF|K\8lHG(B) $B$K7g4Y!#(B $B%$%s%9%H!<%k$5$l$k(B ActiveX $B%3%s%H%m!<%k(B ($B%P!<%8%g%s(B 5.0.93.1 $B0JA0(B) $B$K(B format $B%P%0$,$"$j!"96N,(B web $B%Z!<%8$K%"%/%;%9$5$;$k$HG$0U$N%3!<%I$rCVE-2007-3675

$B!!%P!<%8%g%s(B 5.0.98.0 $B0J9_$G=$@5$5$l$F$$$k!#(BKaspersky Online Virus Scanner $B$rMxMQ$7$?$3$H$,$"$k>l9g$O!"(B http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html $B$K%"%/%;%9$7$F:G?7%P!<%8%g%s$K99?7$9$l$P$h$$!#4XO"(B:

2007.11.01 $BDI5-(B:

$B!!4XO"(B: $B%+%9%Z%k%9%-!<%*%s%i%$%s%9%-%c%J(B $B%5!<%S%9:F3+$N$*CN$i$;(B (just-kaspersky.jp, 2007.10.18)$B!#%"%C%W%G!<%H


$B"#(B 2007.10.10

$B"#(B Citrix$B$,73$d@/I\$N(BWeb$B%5%$%H$rL5KIHw$K!=!=8&5f
(ITmedia, 2007.10.10)

$B!!(BCITRIX: Owning the Legitimate Backdoor (GNUCITIZEN, 2007.10.04) $B$NOC!#$5$"!"7/$b:#$9$0$0$0$C$F$_$h$&(B!

$B$=$NCf$K$O!"@/I\%I%a%$%s$N%$%s%9%?%s%9$,(B10$B7o!"73%I%a%$%s$,(B4$B7o4^$^$l$F$$$?$H$$$&!#(B

$B!!$0$0$k$H$-$K!V(Bext:ica site:.gov$B!W$N$h$&$K$9$l$P(B ok $B$G$9!#(B

2007.10.19 $BDI5-(B:

$B!!4XO"(B:

$B"#(B Patch available for PageMaker buffer overflow vulnerability
(Adobe, 2007.10.09)

$B!!(BPageMaker 7.0.1 / 7.0.2 $B$K7g4Y!#(BPageMaker (PMD) $B%U%!%$%k$N=hM}$K7g4Y$,$"$j!"D9Bg$J%U%)%s%HL>$r4^$`(B PMD $B%U%!%$%k$K$h$C$FG$0U$N%3!<%I$rCVE-2007-5169

$B!!(Bpatch $B$,$"$k$N$GE,MQ$9$l$P$h$$!#4XO"(B:

2007.10.23 $BDI5-(B:

$B!!F|K\8lHG(B: APSB07-15: PageMaker$B$K$*$1$k%P%C%U%!%*!<%P!<%U%m!<$N@H (Adobe)

$B"#(B Illustrator CS3 update to address potential security vulnerabilities
(Adobe, 2007.10.09)

$B!!(BIllustrator CS3 $B$K7g4Y!#96N,(B BMP / DIB / RLE / PNG $B%U%!%$%k$r(B Illustrator CS3 $B$G3+$/$HG$0U$N%3!<%I$rCVE-2007-2244 CVE-2007-2365

$B!!(Bpatch $B$,MQ0U$5$l$F$$$k$N$GE,MQ$9$l$P$h$$!#(B

2007.10.23 $BDI5-(B:

$B!!F|K\8lHG(B: APSB07-16: Illustrator CS3$B$N@x:_E*$J@H (Adobe)

$B"#(B GoLive 9 update to address potential security vulnerabilities
(Adobe, 2007.10.09)

$B!!(BGoLive 9 $B$K7g4Y!#(BGoLive $B%I%-%e%a%s%H$K96N,(B BMP / DIB / RLE / PNG $B%U%!%$%k$rA^F~$9$k$HG$0U$N%3!<%I$rCVE-2007-2244 CVE-2007-2365

$B!!(Bpatch $B$,MQ0U$5$l$F$$$k$N$GE,MQ$9$l$P$h$$!#(B

2007.10.23 $BDI5-(B:

$B!!F|K\8lHG(B: APSB07-17: GoLive 9$B$N@x:_E*$J@H (Adobe)

$B"#(B USB$B%U%i%C%7%e%a%b%j!!IT6q9g$N$*CN$i$;$H$*OM$S(B
(buffalo, 2007.10.10)

$B!!%P%C%U%!%m!<$N(B USB $B%a%b%j(B ($B;XLfG'>Z%b%G%k(B) RUF2-FS$B%7%j!<%:(B$B$N0lIt$K%&%$%k%9(B ($B%*%s%i%$%s%2!<%`%"%+%&%s%HA@$$$N%H%m%$$NLZGO(B) $B$,E:IU$5$l$F$$$kLOMM!#(B

$B7?HV(B            $B@=B$%3!<%I(B      $B%7%j%"%kHV9f(B
-----------------------------------------------------
RUF2-FS512-W 	07/09/11 	000001$B!A(B000360$B$N0lIt(B
RUF2-FS1G-W 	07/09/11 	000001$B!A(B000360$B$N0lIt(B
RUF2-FS2G-W 	07/09/11 	000001$B!A(B000120$B$N0lIt(B

$B!!$3$s$J$3$H$,=q$+$l$F$$$k!#(B

$B"(Ev@=B$%3!<%I$H%7%j%"%kHV9f$,!"6&$K3:Ev$7$F$b!"0J2<#3(B-(2)$B$G$40FFb$7$F$$$k%&%#%k%9%A%'%C%/%D!<%k$K$h$j!"%&%#%k%9$,8!=P$5$l$J$$>l9g$O!"@=IJ$r8r49$9$kI,MW$,$"$j$^$;$s!#0B?4$7$F$4MxMQ$/$@$5$$!#(B

$B!!%P%C%U%!%m!<$O!"$I$N%7%j%"%kHV9f$,%&%$%k%9$D$-$J$N$+$r@53N$K$OGD0.$G$-$F$$$J$$$h$&$@!#(BRUF2-FS$B%7%j!<%:(B $B%&%#%k%9%A%'%C%/%W%m%0%i%`(B$B$G8!::$7$J$$$H$@$a$_$?$$!#(B

$B!!4XO"(B: $B%P%C%U%!%m!<$N(BUSB$B%a%b%j!<$K%&%$%k%9:.F~!"(B186$B8D$rL5=~8r49(B ($BF|7P(B IT Pro, 2007.10.10)

$B!V3:Ev@=IJ$O(B860$B8D$@$,!"8=;~E@$G;T>l$KN.DL$7$F$$$k$N$O(B186$B8D!W!J%P%C%U%!%m!<9-Js!K$H$$$&!#(B

$B!!$U$`$s!#(B

$B%&%$%k%9:.F~$,H/@8$7$?860x$K$D$$$FF1l$G@8;:$5$l$?$b$N!#;XLfG'>Z$KI,MW$H$J$k%=%U%H%&%(%"$r%U%i%C%7%e%a%b%j!<$K=q$-9~$`9)Dx$,$"$j!"$=$3$G:.F~$7$?$b$N$H9M$($F$$$k!#3:Ev@=IJ0J30$O$3$N3$309)>l$G@=B$$7$F$$$J$$$?$a!"%&%$%k%9:.F~$NLdBj$O5/$3$i$J$$$HH=CG$7$F$$$k!W!J%P%C%U%!%m!<9-Js!K$H$$$&!#(B

$B!!%P%C%U%!%m!<$NIJ>Z$C$F$I$&$J$C$F$k$s$@$m$&!#(B

$B"#(B $BDI5-(B

Safari 3$B$K@H

$B!!(BSafari 3.0.3$B$K ($B%H%l%s%I%^%$%/%m(B $B%;%-%e%j%F%#(B blog, 2007.10.10)

$B%^%$%/%m%=%U%H(B $B%;%-%e%j%F%#>pJs$N;vA0DLCN(B - 2007 $BG/(B 10 $B7n(B

$B!!(B$B=P$^$7$?(B$B!#$?$@$7(B Bulletin 5 $B$O8x3+Cf;_$K$J$C$F$$$^$9!#(B

$B!!4XO"(B:

$B$$$m$$$m(B (2007.10.07)

$B!!(Bxfs 1.0.5 $B$G$O(B CVE-2007-4990 $B$bD>$C$F$$$k$=$&$@!#(Bswap_char2b $B4X?t$@$=$&$@!#(B

[SA27009] Sun Java JRE Multiple Vulnerabilities

$B!!$^$@$"$C$?(B: 103071: Java Runtime Environment (JRE) May Allow Untrusted Applets or Applications to Display An Oversized Window so that the Warning Banner is Not Visible to User (Sun)$B!#(BCVE-2007-5240$B!#=$@5%P!<%8%g%s$O>e5-$HF1$8!#(B

$B"#(B Protecting Browsers from DNS Rebinding Attacks
(crypto.stanford.edu, 2007.08.17)

$B!!(BDNS pinning $B4XO"OC!#(BIE 6 $B$H(B Opera 9 $B$O$@$a$_$?$$!#(B CVE-2007-5276 (Opera 9) CVE-2007-5277 (IE 6)$B!#(B $B$"$H!"(BFlash Player 9 $B$b$@$a$_$?$$!#(B CVE-2007-5275

2007.10.17 $BDI5-(B:

$B!!DI2C(B: Sun Java VM: CVE-2007-5375

$B"#(B $B$$$m$$$m(B (2007.10.10)
(various)


$B"#(B 2007.10.09

$B"#(B Safari 3$B$K@H
(ITmedia, 2007.10.09)

$B!!(BZero-day Flaw in Safari 3.0.03 Web Browser for Windows (trendmicro blog, 2007.10.08) $B$NOC!#$^$!!"&B$G$9$7!#(B

2007.10.10 $BDI5-(B:

$B!!(BSafari 3.0.3$B$K ($B%H%l%s%I%^%$%/%m(B $B%;%-%e%j%F%#(B blog, 2007.10.10)

2007.11.16 $BDI5-(B:

$B!!4XO"(B:

$B"#(B $BDI5-(B

Double Whammy! Another Sony Case (And it's Not BioShock)

$B!!(B9/28 $BIU$G(B patch $B=P$F$$$^$9(B: $B;XLfG'>Z5!G=$D$-%]%1%C%H%S%C%HIUB0%=%U%H%&%'%"$N@H ($B%=%K!<(B, 2007.09.28)

$B!!F1$8%M%?$+(B?! UD-SecurityII$B!J(BHUD-SC256J2$B!K$N@H ($B%O%.%o%i%7%9%3%`(B, 2007.10.05)

0day: PDF pwns Windows

$B!!(BAdobe $B$,7g4Y$NB8:_$r3NG'!#(BWindows XP + IE 7 $B$N4D6-$G7g4Y$,H/8=$9$k!#(B Windows Vista $B$G$O$3$N7g4Y$OH/8=$7$J$$!#(B Acrobat / Adobe Reader 8.x $B$N>l9g$O!"%l%8%9%H%j@_Dj$K$h$C$F(B mailto: URL $B$rL58z$K$9$k$3$H$G2sHr$G$-$k!#(B

$B!!%l%8%9%H%j%-!<$O(B:

  • Acrobat:
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\8.0\FeatureLockDown\cDefaultLaunchURLPerms
  • Adobe Reader:
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\8.0\FeatureLockDown\cDefaultLaunchURLPerms

$B!!(BtSchemePerms $B$N%G%U%)%k%HCM$O$3$&$J$C$F$$$k$i$7$$(B:

version:1|shell:3|hcp:3|ms-help:3|ms-its:3|ms-itss:3|its:3|mk:3|mhtml:3|help:3|
disk:3|afp:3|disks:3|telnet:3|ssh:3|acrobat:2|mailto:2|file:2

$B!!

  • mailto $B$rL58z$K$9$k>l9g$O(B tSchemePerms $B$G(B mailto: $B$K(B 3 $B$r@_Dj$9$k(B
    version:1|shell:3|hcp:3|ms-help:3|ms-its:3|ms-itss:3|its:3|mk:3|mhtml:3|help:3|
    disk:3|afp:3|disks:3|telnet:3|ssh:3|acrobat:2|mailto:3|file:2
  • $B%W%m%s%W%H$rI=<($9$k>l9g$O(B tSchemePerms $B$+$i(B mailto: $B$r:o=|$9$k(B
    version:1|shell:3|hcp:3|ms-help:3|ms-its:3|ms-itss:3|its:3|mk:3|mhtml:3|help:3|
    disk:3|afp:3|disks:3|telnet:3|ssh:3|acrobat:2|file:2
Ruby Net::HTTPS library does not validate server certificate CN

$B!!>e5-(B patch $BE,MQ:Q$N(B Ruby 1.8.5 / 1.8.6 (1.8.6-p110 / 1.8.5-p113) $B$,MQ0U$5$l$F$$$k$=$&$G$9!#?"ED$5$s>pJs$"$j$,$H$&$4$6$$$^$9!#(B


$B"#(B 2007.10.07

$B"#(B $B$$$m$$$m(B (2007.10.07)
(various)

2007.10.10 $BDI5-(B:

$B!!(Bxfs 1.0.5 $B$G$O(B CVE-2007-4990 $B$bD>$C$F$$$k$=$&$@!#(Bswap_char2b $B4X?t$@$=$&$@!#(B


$B"#(B 2007.10.06

$B"#(B $B@HZMQ2hA|$r:n@.(B
(Kanasansoft Web Lab., 2007.10.04)

$B%f!<%6$,2hA|$rEj9F$G$-!"Ej9F$5$l$?2hA|$r%V%i%&%6>e$GI=<($9$k$h$&$J(BWeb$B%"%W%j%1!<%7%g%s$N>l9g!"$3$N@H

$B!!(BWeb $B%"%W%j$N4IM}

$B"#(B [SA27009] Sun Java JRE Multiple Vulnerabilities
(Secunia, 2007.10.04)

$B!!(BSun Java JDK / SDK / JRE $B$KJ#?t$N7g4Y!#(B

$B!!0J2<$N%P!<%8%g%s$G=$@5$5$l$F$$$k(B:

2007.10.10 $BDI5-(B:

$B!!$^$@$"$C$?(B: 103071: Java Runtime Environment (JRE) May Allow Untrusted Applets or Applications to Display An Oversized Window so that the Warning Banner is Not Visible to User (Sun)$B!#(BCVE-2007-5240$B!#=$@5%P!<%8%g%s$O>e5-$HF1$8!#(B


$B"#(B 2007.10.05

$B"#(B $B$$$m$$$m(B (2007.10.05)
(various)

$B"#(B Web Page Code Injection via ARP Spoofing
(McAfee blog, 2007.09.18)

$B!!(BARP Spoofing (ARP $B:>>N(B) $B$r;H$C$?(B Web $B%Z!<%82~$6$s$,N.9T$C$F$$$k$h$&$G$9!#Nc(B:

$B!!

  1. $BL\I8$H$J$k%5%V%M%C%H$r(B scan $B$7!"96N,$G$-$k%[%9%H$rC5$7=P$7!"96N,$9$k!#(B

  2. $B96N,$7$?%[%9%H$K%H%m%$$NLZGO$r@_CV$9$k!#(B

  3. $B%H%m%$$NLZGO$+$i:>>N(B ARP $B%Q%1%C%H$r%5%V%M%C%HFb$N%[%9%H$H%2!<%H%&%'%$$KN.$9!#(B

  4. $B:>>N(B ARP $B%Q%1%C%H$r

    • ARP Spoofing $BA0(B: [$B%2!<%H%&%'%$(B] $B"+"*(B [$B%[%9%H(B]
    • ARP Spoofing $B8e(B: [$B%2!<%H%&%'%$(B] $B"+"*(B [$B96N,$5$l$?%[%9%H(B] $B"+"*(B [$B%[%9%H(B]
  5. $B%H%m%$$NLZGO$ODL?.FbMF$r2~$6$s$7!"(B<iframe> $B%?%0$J$I$rA^F~$7$?$j$9$k!#(B

2007.10.13 $BDI5-(B:

$B!!(BNod to more ARP mayhem ? (McAfee blog, 2007.10.11)$B!#(BNOD32 $B$G$*$J$8$_(B ESET $B$NCf9q%5%$%H$b$3$l$G%d%i%l$?$h$&$G!#(B

2007.10.23 $BDI5-(B:

$B!!(BARP$B%9%W!<%U%#%s%0!'FI ($BF|7P(B IT Pro, 2007.10.19)$B!#(B ARP Spoofing: Is Your Web Hosting Service Protected ? $B$NK]Lu5-;v!#(B

2007.12.25 $BDI5-(B:

$B!!(BARP spoofing HTTP infection malware (Websense blog, 2007.12.21)

2008.06.02 $BDI5-(B:

$B!!>e5-$NF|K\8lLu(B: HTTP$B1~Ez%Q%1%C%H$r0-MQ$9$k(BARP$B%9%W!<%U%#%s%0!&%&%$%k%9(B ($BF|7P(B IT Pro, 2008.01.28)

$B"#(B $BDI5-(B

$B"#(B $B%^%$%/%m%=%U%H(B $B%;%-%e%j%F%#>pJs$N;vA0DLCN(B - 2007 $BG/(B 10 $B7n(B
(Microsoft, 2007.10.04)

$B!!$b$&$=$s$J5(@a$G$9!#(B

  • $B6[5^(B: 4

    Bulletin 1

    $BBP>](B: Windows 2000 / XP / Server 2003

    Bulletin 2

    $BBP>](B: Outlook Express 5.5 / 6, Windows Mail

    Bulletin 3

    $BBP>](B: IE 5.01 / 6 / 7

    Bulletin 6

    $BBP>](B: Word 2000 / 2002, Office 2004 for Mac

  • $B=EMW(B: 3

    Bulletin 4

    $BBP>](B: Windows 2000 / XP / Server 2003 / Vista

    Bulletin 5

    $BBP>](B: Windows 2000 / Server 2003

    Bulletin 7

    $BBP>](B: SharePoint Services 3.0, SharePoint Server 2007

2007.10.10 $BDI5-(B:

$B!!(B$B=P$^$7$?(B$B!#$?$@$7(B Bulletin 5 $B$O8x3+Cf;_$K$J$C$F$$$^$9!#(B

$B!!4XO"(B:

2007.10.11 $BDI5-(B:

$B!!(BMS07-060 - $B6[5^(B: Microsoft Word $B$N@H $B$N!"(BOffice 2004 for Mac $BMQ$N(B exploit $B$,B8:_$9$kLOMM(B:

2007.10.20 $BDI5-(B:

$B!!(BMS07-060 $B$r96N,$9$k!"(BWindows $BMQ$N%&%$%k%9$,B8:_$9$kLOMM(B:

$B"#(B [SA26970] Altnet Download Manager ActiveX Control Buffer Overflow Vulnerability
(Secunia, 2007.10.04)

$B!!(BAltnet Download Manager 4.x ActiveX $B%3%s%H%m!<%k(B (adm4.dll) $B$K7g4Y!#(B Install() $B%a%=%C%I$K(B buffer overflow $B$9$k7g4Y$,$"$j!"96N,(B Web $B%5%$%H$,G$0U$N%3!<%I$rCVE-2007-5217

$B!!$^$@=$@5$5$l$F$$$J$$!#4XO"(B:


$B"#(B 2007.10.04

$B"#(B $BDI5-(B

0DAY: QuickTime pwns Firefox

$B!!(BQuickTime 7.2 $B$N%;%-%e%j%F%#%"%C%W%G!<%H$K$D$$$F(B (Apple) $B$,EP>l!#(BQuickTime $BB&$G$b$3$N7g4Y$,=$@5$5$l$?!#(BCVE-2007-4673

$B!!(BC:\ProgramFiles\QuickTime\QTSystem\QuickTime.qts $B%U%!%$%k$N%W%m%Q%F%#$G=$@58e$N%P!<%8%g%s(B 7.2.0.245 $B$r3NG'$G$-$k$=$&$G!#(B


$B"#(B 2007.10.03

$B"#(B $BDI5-(B

$B"#(B $BCf9q%;%-%e%j%F%#AH?%$N(BWeb$B%5%$%H$K$o$J!"%&%$%k%946@w$N62$l(B
($BF|7P(B IT Pro, 2007.10.03)

$B!!85$M$?(B: CISRT Under Attack *gasps* (trendmicro blog, 2007.10.02)$B!#4XO"(B: ARP attack to CISRT.org (CISRT, 2007.10.02)$B!#(B $BN>

$B"#(B $B$$$m$$$m(B (2007.10.03)
(various)

$B"#(B Ruby Net::HTTPS library does not validate server certificate CN
(iSEC Partners, 2007.09.28)

$B!!(BRuby 1.8.6 $B0JA0(B (?) $B$N(B Net::HTTPS $B%i%$%V%i%j$K7g4Y!#(B $B@\B38e$K%5!<%P>ZL@=q$N(B commonName $B%U%#!<%k%I$r8!::$7$J$$!#(B Ruby 1.8.5 / 1.8.6 $B$N(B SVN $BHG$G$O=$@5$5$l$F$$$k!#(B CVE-2007-5162

2007.10.09 $BDI5-(B:

$B!!>e5-(B patch $BE,MQ:Q$N(B Ruby 1.8.5 / 1.8.6 (1.8.6-p110 / 1.8.5-p113) $B$,MQ0U$5$l$F$$$k$=$&$G$9!#?"ED$5$s>pJs$"$j$,$H$&$4$6$$$^$9!#(B

2007.11.14 $BDI5-(B:

$B!!(BNet::ftptls, Net::telnets, Net::imap, Net::pop, Net::smtp $B$K$bF1MM$NLdBj$,$"$j!"(B Revision 13656 $B$GD>$C$F$$$kLOMM!#(BCVE-2007-5770$B!#(B


$B"#(B 2007.10.02


$B"#(B 2007.10.01


[$B%;%-%e%j%F%#%[!<%k(B memo]
$B;d$K$D$$$F(B