CVE-2009-2511 (CNNVD-200910-219)
中文标题:
Internet Explorer X.509 Certificate Common Name Encoding 多个安全绕过漏洞
英文标题:
Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, W...
漏洞描述
中文描述:
Microsoft Windows 2000 SP4, Windows XP SP2 和 SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, 和SP2, Windows Server 2008 Gold, SP2, 和 R2, 和 Windows 7的 CryptoAPI组件存在整数值溢出。它允许中间人攻击者可以借助具有畸形的ASN.1 Object的 Identifier (OID)X.509证书，骗取SSL服务器和其他权限。该漏洞又称"整数值溢出 X.509 Object Identifiers漏洞"。
英文描述:
Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows man-in-the-middle attackers to spoof arbitrary SSL servers and other entities via an X.509 certificate that has a malformed ASN.1 Object Identifier (OID) and was issued by a legitimate Certification Authority, aka "Integer Overflow in X.509 Object Identifiers Vulnerability."
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| microsoft | windows_2000 | * | - | - |
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
|
| microsoft | windows_7 | - | - | - |
cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*
|
| microsoft | windows_server_2003 | * | - | - |
cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
|
| microsoft | windows_server_2008 | * | - | - |
cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*
|
| microsoft | windows_vista | * | - | - |
cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
|
| microsoft | windows_xp | * | - | - |
cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
AV:N/AC:L/Au:N/C:P/I:P/A:P
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2009-2511 |
2025-11-11 15:18:10 | 2025-11-11 07:33:02 |
| NVD | nvd_CVE-2009-2511 |
2025-11-11 14:53:01 | 2025-11-11 07:41:49 |
| CNNVD | cnnvd_CNNVD-200910-219 |
2025-11-11 15:09:06 | 2025-11-11 07:49:39 |
| EXPLOITDB | exploitdb_EDB-33264 |
2025-11-11 15:05:56 | 2025-11-11 08:27:57 |
版本与语言
安全公告
变更历史
查看详细变更
- references_count: 3 -> 6
- tags_count: 0 -> 4
- data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']
查看详细变更
- vulnerability_type: 未提取 -> 数字错误
- cnnvd_id: 未提取 -> CNNVD-200910-219
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
- cvss_score: 未提取 -> 7.5
- cvss_vector: NOT_EXTRACTED -> AV:N/AC:L/Au:N/C:P/I:P/A:P
- cvss_version: NOT_EXTRACTED -> 2.0
- affected_products_count: 0 -> 6
- data_sources: ['cve'] -> ['cve', 'nvd']