Trend Micro Security

MS15-041：.NET Framework の脆弱性により、情報漏えいが起こる (3048010)

2015年4月22日
  危険度: : 高
  CVE識別番号: CVE-2015-1648

  概要

This update resolves an information disclosure vulnerability in the following Microsoft .NET Framework versions:

  • Microsoft .NET Framework 1.1 Service Pack 1
  • Microsoft .NET Framework 2.0 Service Pack 2
  • Microsoft .NET Framework 3.5
  • Microsoft .NET Framework 3.5.1
  • Microsoft .NET Framework 4
  • Microsoft .NET Framework 4.5/4.5.1/4.5.2

The vulnerability exists in the way ASP.NET handles requests in systems using custom error messages. An attacker sends a specially crafted web request to the vulnerable server.

  トレンドマイクロの対策

詳しい情報については以下のサイトをご参照ください。

  対応方法

  影響を受けるソフトウェア

  • Windows 8.1 for 32-bit Systems
  • Windows 8.1 for x64-based Systems
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2003 Service Pack 2
  • Windows Server 2003 x64 Edition Service Pack 2
  • Windows Server 2003 with SP2 for Itanium-based Systems
  • Windows Vista Service Pack 2
  • Windows Vista x64 Edition Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
  • Windows 8 for 32-bit Systems
  • Windows 8 for x64-based Systems
  • Windows RT
  • Windows RT 8.1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)