JVN iPedia - Ǝ㐫΍f[^x[X^g
g

[English]

Ǝ㐫΍f[^x[X(ڍ׃y[W)̓ǂݕ

JVNDB-XXXX-XXXXXX (Ǝ㐫΍f[^x[Xo^ԍ)

uƎ㐫̃^Cgv

Ǝ㐫΍f[^x[Xo^ԍ́AƎ㐫΍f[^x[X(JVN iPedia)ɓo^ĂƎ㐫ŗL̔ԍłBႦ΁uJVNDB-2007-001234v̂悤ȔԍƎ㐫PʂɊU܂B4 P^\L"2007"́AUꂽƎ㐫񂪔ꂽNA6P^\L"001234"́AN̒ʂԍ\܂B

uƎ㐫̃^Cgv́Aǂ̃VXe(i)ɂǂ̂悤ȐƎ㐫݂邩܂B

Tv

Ǝ㐫̌ŗL̊Tv1, 2sŋLq܂Bmڍׂȏ񂪕Kvȏꍇ́Ax_܂QlQƉB2007NO̐Ǝ㐫΍ȂǁA{f[^x[XJO(2007N425)ɒ~ςꂽꕔeɂ‚Ă͋Lq[قȂAƎ㐫̌ŗL̊Tvł͂Ȃ֘A镡̐Ǝ㐫̊TvLqĂꍇ܂B

CVSSɂ[x

1.uCVSSvƂ́H

Ǝ㐫΍f[^x[Xł́AʐƎ㐫]VXeCVSS(Common Vulnerability Scoring System)pāA]ʂCVSS{l̕]eLڂAƎ㐫̌ŗL[x\Ă܂BȂACVSSɂ́AFIRST2007N620ɌJꂽʐƎ㐫]VXeCVSSv2A2015N610ɌJꂽCVSSv3݂AJVNiPediał2015N121ZLeBxp[gi[Vbvŕ񍐂ꂽƎ㐫ΏۂCVSSv2ACVSSv3𕹋LČJĂ܂B

JVN iPediał̕\


CVSSv2 CVSSv3

2.uCVSSv2vƁuCVSSv3v̈Ⴂɂ‚

CVSSv2́AUΏۂƂȂzXgVXeɂẮuƎ㐫ɂ[xv]Ă܂ACVSSv3ł́AzTh{bNXȂǂiłĂ邱ƂAR|[lgPʂŕ]@荞񂾎dlƂȂĂ܂B

3.[IPAl] [NVDl] ɂ‚

[xɕ\ [IPAl] [NVDl] ́Aǂ̑gD][x\܂B[IPAl]A[NVDl] ꂼ̑gD͈ȉ̂ƂłB[IPAl] [NVDl] ݂̂́A[IPAl] D\Ă܂B

CVSS[x]ʂ\gD̕\ɂ‚
\
[IPAl] Ɨs@l 񏈗i@\(IPA)ɂCVSS[x](CVSS{l)ł邱Ƃ\܂B
[NVDl] NIST(National Institute of Standards and Technology)^cƎ㐫f[^x[XNVD(National Vulnerability Database)ɌJĂ](CVSS{l)ł邱Ƃ\܂B

4.CVSSvZ@ɂ‚

Ǝ㐫΍f[^x[X̏ڍ׃y[WCVSSɂ[x\ĂꍇAR‚̊[{]({l)A]A‹]]ŐƎ㐫]邱ƂłCVSS vZ@(CVSS Calculator)𗘗p邱Ƃł܂BCVSSvZ@̎gɂ‚ẮAQƉB

e󂯂VXe

e󂯂鐻i(OSAvP[VACuAgݐiȂ)̖̂Ƃo[WԍȂǂx_Ƃɗ񋓂܂Bi̍ۂɑIíAɗ񋓂鐻iɊY邩r܂B

z肳e

Ǝ㐫pꂽꍇAe󂯂鐻ĩ[Uɑ΂Ăǂ̂悤ȔQz肳邩Lq܂BU邽߂̏(Ⴆ΁AǗҌł炩߃VXeɃOCĂKv铙)ɊւAɊ܂܂܂B

΍

e󂯂VXe̊J񋟂x_΍̑ݗLmF邱Ƃł܂B܂Co[WȂǂ̑΍Ɋւ⑫ɂ‚ĂAɊ܂܂܂B

x_

΍Ǝ㐫̑Ή󋵁A܂Ɋ֘A񂪋LڂĂx_AhoCUCo[W̃[Xm[gȂǂւ̃Nx_ƂɋLڂ܂B

Ǝ㐫Ɋ֘Ax_mF邱ƂoȂ܂͕smȏꍇɂ́Ax_̃gbvy[WLڂꍇ܂B

Ql

JVN TCg⍑ȎgDAZLeB|[^TCgJ֘Aւ̃NLڂ܂B

XV

eCۂɍXVeȌɋLڂ܂Bx_Qlւ̃NljȂǂ͗̋LڑΏۂƂȂꍇ܂B

tɂ‚

1.\

x_AhoCǓJAgDZLeB|[^TCg̓o^/JA҂ʌɕ񍐂ȂǁAƎ㐫΍񂪈ʂɌ\ꂽtLڂ܂B

2.o^

Ǝ㐫΍f[^x[Xŏ߂ČJꂽtLڂ܂B{f[^x[XJO(2007N425)ɒ~ςƎ㐫΍́Ao^\u2007N0401vɓꂳĂ܂B(A2007N42424܂łɐVKo^{ꕔf[^͏)

3.ŏIXV

Ǝ㐫΍XVꂽŌ̓tLڂ܂BXVĂȂ͓o^ƓtLڂ܂B


CVSS vZ@̎g

CVSSɂ‚ĂQƉB

菇

  1. eƎ㐫΍̏ڍ׃y[WɋLڂCVSSv2A܂CVSSv3̊{l(l)NbN邱ƂŁACVSSvZ@VEBhEŊJ܂B
  2. CVSS vZ@ɂ́Al̃NbNsƎ㐫CVSS{l̕]eACVSSvZ@Ƀp[^ƂĈn܂B
  3. p҂cĂAi̗p‹gp󋵁AUR[h݂̑Ȃǂ̏ƂɁAKvȌ]A‹]̊e]ڂɂ‚āAv_Ej[I܂B

̎g

1.{

@͂āuv{^NbNƁǍɃ}b`Ǝ㐫΍񂪕\܂B

2.

@ĽpӂĂ܂B̌gp΍i荞݌ɂp邱Ƃł܂B

̎g
L[[h ͂L[[hɊ֘AƎ㐫΍񂪕\܂B
̎g(L[[h̓͗)QƉB
ދ`ꌟ {f[^x[Xœo^Ăދ`ꎫ𗘗pł܂B`FbN{bNXɃ`FbNƁAL[[ȟʂƂ̃L[[hɊ֘Aދ`̌ʂďo͂܂B
x_ {f[^x[Xœo^Ăx_猟ł܂Bv_E猟x_I܂B
i {f[^x[Xœo^Ă鐻i񂩂猟ł܂Bv_E猟iI܂B
ił́AiIOɃx_w肷Kv܂B
x_/i x_AiŃL[[hsAɔf邱Ƃł܂B
ux_/iv{^NbNƃ_CAO\܂̂ŁAL[[hɂ錟s܂B

F
\ Ǝ㐫ꂽtŊ(N)w肵Čł܂Bv_E(N)I܂B܂JnN܂͏IN݂̂̎wł”\łB
ŏIXV {f[^x[XōŏIXVꂽtŊ(N)w肵Čł܂Bv_E(N)IČ邱Ƃł܂Bu\vƓgłB
[x eڍ׃y[WCVSSv3̊{l܂́ACVSSv2̊{l̂ǂ炩ɕ\鎟̐[xIČ邱Ƃł܂BCVSSɂ‚ĂQƉB
[x
CVSS v3{l
ً}
9.0`10.0
dv
7.0`8.9
x
4.0`6.9
0.1`3.9
Ȃ
0
[x
CVSS v2{l
xIII
(댯)
7.0`10.0
xII
(x)
4.0`6.9
xI
()
0.0`3.9

CWE ʐƎ㐫^Cvꗗ(CWE)w肵Čł܂B

3.L[[h̓͗

L[[hł́Ai IDAU@Ȃǂ͂܂B܂Aȉ̂悤ɌXy[Xŋ؂Ă̕ł̌Avł܂B{ł̌ʂ̌Ȃꍇ́ApłĂ݂ĂB(uVXRvuCiscov@Ȃ)

L[[hŌF

  • x_@(uSunvAuxmʁv)
  • i@(uApachevAuOracle@DatabasevAuFirefoxv)
  • U@̖́@(uNXTCgXNveBOvAuobt@I[o[t[vAuDoSv Ȃ)

    • gL[[hɂ‚
    @Ǝ㐫΍񌟍ʂ̌ɑ΂Ĉȉ̊gL[[hw肵ꍇAw肳ꂽL[[hɏ]Čs܂B

    gL[[hꗗ
  • vendor : x_ɑ΂Ďw肳ꂽ̕vs܂B
  • product : iɑ΂Ďw肳ꂽ̕vs܂B

    • gL[[hw@
  • gL[[h: (> vendor:AhrVXeY)


    • gL[[h𓯎Ɏw肵ꍇANDɂ錟s܂B

    (> vendor:apache product:tomcat)

x_AhoCUIDŌF

  • bhnbg ZLeBAvf[g@(uRHSA-2004:120v)
  • ^[{ibNX iZLeB@(uTLSA-2007-13v)
  • 2006NɌJꂽ^[{ibNX iZLeB@(uTLSA-2006v)

JVNTCgIDŌF

  • VN-JP@(uJVN#47272891vAuJVN#v)
  • VN-CERT/CC@(uJVNVU#vAuJVNTA06-283AvAuJVNCA-2004-01v)
  • o^ς VN-CPNI SĂ@(uNISCC-v)
  • TRnotes@(uTRTA07-047Av)

gDZLeB|[^TCgIDŌF

  • CVE,NVD@(uCVE-2007-0001v)
  • US-CERT@(uVU#794752vAuTA07-047AvAuTA06v)
  • XForce@(u27849v)
  • Secunia@(uSA24109v)

₢킹͂