-----BEGIN PGP SIGNED MESSAGE-----

                                                         JPCERT-WR-2006-4801
                                                                   JPCERT/CC
                                                                  2006-12-13

                 <<< JPCERT/CC REPORT 2006-12-13 >>>

$B!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=(B
$B"#(B12/03($BF|(B)$B!A(B12/09($BEZ(B) $B$N%;%-%e%j%F%#4XO">pJs(B
$B!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=(B

== $BL\(B  $B<!(B ===================================================================

$B!Z(B1$B![(BAdobe AcroPDF ActiveX $B%3%s%H%m!<%k$N@H<e@-$K4X$9$kDI2C>pJs(B
$B!Z(B2$B![(BAdobe Download Manager $B$K%P%C%U%!%*!<%P!<%U%m!<$N@H<e@-(B
$B!Z(B3$B![(BMicrosoft Windows Media Player $B$K%R!<%W%*!<%P!<%U%m!<$N@H<e@-(B
$B!Z(B4$B![(BMicrosoft Word $B$NJ8;zNs=hM}$K@H<e@-(B
$B!Z(B5$B![(BGnuPG $B$KJ#?t$N@H<e@-(B
$B!Z(B6$B![(Bl2tpns $B$K%P%C%U%!%*!<%P!<%U%m!<$N@H<e@-(B
$B!Z(B7$B![(BImageKit ActiveX $B%3%s%H%m!<%k$KJ#?t$N%P%C%U%!%*!<%P!<%U%m!<$N@H<e@-(B
$B!Z(B8$B![(BRuby $B$N(B CGI $B%i%$%V%i%j$K@H<e@-(B
$B!Z(B9$B![%8%c%9%H%7%9%F%`$N@=IJ72$K@H<e@-(B
$B!Z(B10$B![(BTikiWiki $B$K%/%m%9%5%$%H%9%/%j%W%F%#%s%0$N@H<e@-(B
$B!Z(B11$B![$7$g$\$7$g$\F|5-%7%9%F%`(B (sns) $B$K%/%m%9%5%$%H%9%/%j%W%F%#%s%0$N@H<e@-(B

  $B"(>R2p$9$k%;%-%e%j%F%#4XO">pJs$NA*Dj4p=`$O0J2<$N%Z!<%8$r$4Mw$/$@$5$$!#(B
        http://www.jpcert.or.jp/wr/

  $B"((BHTML $BHG$*$h$S(B XML $BHG$O0J2<$N%Z!<%8$r$4Mw$/$@$5$$!#(B
        http://www.jpcert.or.jp/wr/2006/wr064801.html
        http://www.jpcert.or.jp/wr/2006/wr064801.xml
=============================================================================


$B!Z(B1$B![(BAdobe AcroPDF ActiveX $B%3%s%H%m!<%k$N@H<e@-$K4X$9$kDI2C>pJs(B

    $B>pJs8;(B
      US-CERT Vulnerability Note VU#198908
      Adobe Acrobat AcroPDF ActiveX control fails to properly handle malformed input
      http://www.kb.cert.org/vuls/id/198908

    $B35MW(B
      JPCERT/CC REPORT 2006-12-06$B9f!Z(B2$B![$G>R2p$7$?!"(BAdobe AcroPDF
      ActiveX $B%3%s%H%m!<%k$N@H<e@-$K4X$9$kDI2C>pJs$G$9!#(B

      2006$BG/(B12$B7n(B7$BF|$K!"(BUS-CERT Vulnerability Note VU#198908$B!V(BAdobe
      Acrobat AcroPDF ActiveX control fails to properly handle
      malformed input$B!W$K$*$$$F!"K\@H<e@-$KBP1~$7$?(B Adobe Reader 8 $B$N(B
      $B%j%j!<%9$,Js9p$5$l$F$$$^$9!#(B

      Adobe Reader $B$r;HMQ$7$F$$$k>l9g$O!"B.$d$+$K(B Adobe Reader 8 ($B$^$?(B
      $B$O$=$l0J9_(B) $B$K0\9T$9$k$3$H$r?d>)$7$^$9!#(B

    $B4XO"J8=q(B ($BF|K\8l(B)
      JPCERT/CC REPORT 2006-12-06$B9f(B
      $B!Z(B2$B![(BAdobe AcroPDF ActiveX $B%3%s%H%m!<%k$K@H<e@-(B
      http://www.jpcert.or.jp/wr/2006/wr064701.html#2

      $B%"%I%S(B $B%7%9%F%`%:<R(B
      $B%;%-%e%j%F%#>pJs(B
      http://www.adobe.com/jp/support/security/

    $B4XO"J8=q(B ($B1Q8l(B)
      Adobe Security bulletin APSB06-20
      Update available for potential vulnerabilities in Adobe Reader and Adobe Acrobat 7
      http://www.adobe.com/support/security/bulletins/apsb06-20.html

$B!Z(B2$B![(BAdobe Download Manager $B$K%P%C%U%!%*!<%P!<%U%m!<$N@H<e@-(B

    $B>pJs8;(B
      US-CERT Vulnerability Note VU#448569
      Adobe Download Manager buffer overflow
      http://www.kb.cert.org/vuls/id/448569

      CIAC Bulletin R-066
      Adobe Download Manager Vulnerability
      http://www.ciac.org/ciac/bulletins/r-066.shtml

    $B35MW(B
      Adobe Download Manager $B$K$O%P%C%U%!%*!<%P!<%U%m!<$N@H<e@-$,$"$j$^(B
      $B$9!#7k2L$H$7$F!"1s3V$NBh;0<T$,G$0U$N%3!<%I$r<B9T$9$k2DG=@-$,$"$j(B
      $B$^$9!#(B

      $BBP>]$H$J$k%P!<%8%g%s$O0J2<$NDL$j$G$9!#(B

      - Adobe Download Manager 2.1 $B$*$h$S$=$l0JA0(B

      $B$3$NLdBj$O!"G[I[85$,Ds6!$9$k=$@5:Q$_$N%P!<%8%g%s(B 2.2 ($B$^$?$O$=$l(B
      $B0J9_(B) $B$K(B Adobe Download Manager $B$r99?7$9$k$3$H$G2r7h$7$^$9!#(B

      $B$J$*!"A09`!V(BAdobe AcroPDF ActiveX $B%3%s%H%m!<%k$N@H<e@-$K4X$9$kDI(B
      $B2C>pJs!W$K1w$$$F8@5Z$5$l$F$$$k(B Adobe Reader 8 ($B$^$?$O$=$l0J9_(B)
      $B$r%$%s%9%H!<%k$9$k$3$H$G!"(BAdobe Download Manager $B$bF1;~$K99?7$5(B
      $B$l$^$9(B

      $B>\:Y$K$D$$$F$O!"%Y%s%@!<$,Ds6!$9$k>pJs$r;2>H$7$F$/$@$5$$!#(B

    $B4XO"J8=q(B ($BF|K\8l(B)
      $B%"%I%S(B $B%7%9%F%`%:<R(B
      $B%;%-%e%j%F%#>pJs(B
      http://www.adobe.com/jp/support/security/

      $B%"%I%S(B $B%7%9%F%`%:<R(B
      Adobe Download Manager$B$K$D$$$F(B
      http://www.adobe.com/jp/products/acrobat/acrrmanager.html

    $B4XO"J8=q(B ($B1Q8l(B)
      Adobe Security bulletin APSB06-19
      Update available for buffer overflow in Adobe Download Manager
      http://www.adobe.com/support/security/bulletins/apsb06-19.html

$B!Z(B3$B![(BMicrosoft Windows Media Player $B$K%R!<%W%*!<%P!<%U%m!<$N@H<e@-(B

    $B>pJs8;(B
      US-CERT Vulnerability Note VU#208769
      Microsoft Windows Media Player fails to properly handle malformed Windows Media Metafiles
      http://www.kb.cert.org/vuls/id/208769

      CIAC Bulletin R-068
      Microsoft Windows Media Player
      http://www.ciac.org/ciac/bulletins/r-068.shtml

    $B35MW(B
      Microsoft Windows Media Player $B$K$O%R!<%W%*!<%P!<%U%m!<$N@H<e@-(B
      $B$,$"$j$^$9!#7k2L$H$7$F!"1s3V$NBh;0<T$,(B Windows Media $B%a%?%U%!%$(B
      $B%k$r;HMQ$7$FG$0U$N%3!<%I$r<B9T$7$?$j!"(BWindows Media Player $B$r%/(B
      $B%i%C%7%e$5$;$?$j$9$k2DG=@-$,$"$j$^$9!#(B

      2006$BG/(B12$B7n(B12$BF|8=:_!"$3$NLdBj$r2r7h$9$k%;%-%e%j%F%#99?7%W%m%0%i%`(B
      $B$ODs6!$5$l$F$$$^$;$s!#$3$NLdBj$O!"?.Mj$G$-$J$$(B Windows Media $B%a(B
      $B%?%U%!%$%k$K%"%/%;%9$7$J$$!"$"$k$$$O(B Windows Media $B%a%?%U%!%$%k(B
      $B$r<+F0E*$K3+$+$J$$$h$&$K(B Web $B%V%i%&%6$r@_Dj$9$k$J$I$NJ}K!$G2sHr(B
      $B$G$-$^$9!#>\:Y$K$D$$$F$O%Y%s%@$,Ds6!$9$k>pJs$r;2>H$7$F$/$@$5$$!#(B

$B!Z(B4$B![(BMicrosoft Word $B$NJ8;zNs=hM}$K@H<e@-(B

    $B>pJs8;(B
      US-CERT Vulnerability Note VU#167928
      Microsoft Word malformed string vulnerability
      http://www.kb.cert.org/vuls/id/167928

      CIAC Bulletin R-063
      Vulnerability in Microsoft Word
      http://www.ciac.org/ciac/bulletins/r-063.shtml

    $B35MW(B
      Microsoft Word $B$K$OJ8;zNs$N=hM}$K5/0x$9$k@H<e@-$,$"$j$^$9!#7k2L$H(B
      $B$7$F!"1s3V$NBh;0<T$,G$0U$N%3!<%I$r<B9T$9$k2DG=@-$,$"$j$^$9!#(B

      $BBP>]$H$J$k@=IJ$H%P!<%8%g%s$O0J2<$NDL$j$G$9!#(B

      - Word 2000
      - Word 2002
      - Word 2003
      - Word Viewer 2003
      - Word 2004 for Mac
      - Word 2004 v.X for Mac
      - Works 2004$B!"(B2005$B!"$*$h$S(B 2006

      2006$BG/(B12$B7n(B12$BF|8=:_!"$3$NLdBj$r2r7h$9$k%;%-%e%j%F%#99?7%W%m%0%i%`(B
      $B$ODs6!$5$l$F$$$^$;$s!#$3$NLdBj$r2sHr$9$k$K$O!"IT?3$J(B Word $B%U%!%$(B
      $B%k$r3+$+$J$$$h$&Cm0U$9$kI,MW$,$"$j$^$9!#>\:Y$K$D$$$F$O%Y%s%@$,Ds(B
      $B6!$9$k>pJs$r;2>H$7$F$/$@$5$$!#(B

    $B4XO"J8=q(B ($BF|K\8l(B)
      $B%^%$%/%m%=%U%H(B $B%;%-%e%j%F%#(B $B%"%I%P%$%6%j(B (929433)
      Microsoft Word $B$N@H<e@-$K$h$j!"%j%b!<%H$G%3!<%I$,<B9T$5$l$k(B
      http://www.microsoft.com/japan/technet/security/advisory/929433.mspx

      JP Vendor Status Notes JVNVU#167928
      Microsoft Word $B$NJ8;zNs=hM}$K4X$9$k@H<e@-(B
      http://jvn.jp/cert/JVNVU%23167928/index.html

$B!Z(B5$B![(BGnuPG $B$KJ#?t$N@H<e@-(B

    $B>pJs8;(B
      CIAC Bulletin R-064
      GnuPG Security Update
      http://www.ciac.org/ciac/bulletins/r-064.shtml

    $B35MW(B
      GnuPG $B$K$OJ#?t$N@H<e@-$,$"$j$^$9!#7k2L$H$7$F!"1s3V$NBh;0<T$,G$0U(B
      $B$N%3!<%I$r<B9T$9$k$J$I$N2DG=@-$,$"$j$^$9!#(B

      $BBP>]$H$J$k%P!<%8%g%s$O0J2<$NDL$j$G$9!#(B

      - GnuPG 1.4.5 $B$*$h$S$=$l0JA0(B
      - GnuPG 2.0.1 $B$*$h$S$=$l0JA0(B

      $B$3$NLdBj$O!";HMQ$7$F$$$k(B OS $B$N%Y%s%@$dG[I[85$,Ds6!$9$k=$@5:Q$_$N(B
      $B%P!<%8%g%s$K(B GnuPG $B$r99?7$9$k$3$H$G2r7h$7$^$9!#(B

    $B4XO"J8=q(B ($B1Q8l(B)
      Gnupg-announce mailing list
      [Announce] GnuPG 1.4 and 2.0 buffer overflow
      http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html

      Gnupg-announce mailing list
      [Announce] GnuPG: remotely controllable function pointer [CVE-2006-6235]
      http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html

      Red Hat Security Advisory RHSA-2006:0754-2
      Important: gnupg security update
      https://rhn.redhat.com/errata/RHSA-2006-0754.html

$B!Z(B6$B![(Bl2tpns $B$K%P%C%U%!%*!<%P!<%U%m!<$N@H<e@-(B

    $B>pJs8;(B
      CIAC Bulletin R-067
      l2tpns Buffer Overflow
      http://www.ciac.org/ciac/bulletins/r-067.shtml

    $B35MW(B
      $B%l%$%d(B 2 $B%H%s%M%j%s%0%W%m%H%3%k%M%C%H%o!<%/%5!<%P$G$"$k(B l2tpns 
      $B$K$O%P%C%U%!%*!<%P!<%U%m!<$N@H<e@-$,$"$j$^$9!#7k2L$H$7$F!"1s3V$N(B
      $BBh;0<T$,G$0U$N%3!<%I$r<B9T$9$k2DG=@-$,$"$j$^$9!#(B

      $B$3$NLdBj$O!";HMQ$7$F$$$k(B OS $B$N%Y%s%@$dG[I[85$,Ds6!$9$k=$@5:Q$_$N(B
      $B%Q%C%1!<%8$K(B l2tpns $B$r99?7$9$k$3$H$G2r7h$7$^$9!#(B

    $B4XO"J8=q(B ($B1Q8l(B)
      l2tpns
      Release Name: 2.1.21
      http://sourceforge.net/project/shownotes.php?group_id=97282&release_id=468202

      Debian Security Advisory DSA-1230-1
      l2tpns -- buffer overflow
      http://www.debian.org/security/2006/dsa-1230

$B!Z(B7$B![(BImageKit ActiveX $B%3%s%H%m!<%k$KJ#?t$N%P%C%U%!%*!<%P!<%U%m!<$N@H<e@-(B

    $B>pJs8;(B
      US-CERT Vulnerability Note VU#210697
      Newtone ImageKit ActiveX buffer overflow vulnerabilities
      http://www.kb.cert.org/vuls/id/210697

    $B35MW(B
      $B%$%a!<%8=hM}$r9T$&%3%s%]!<%M%s%H$G$"$k(B ImageKit ActiveX $B%3%s%H%m(B
      $B!<%k$K$OJ#?t$N%P%C%U%!%*!<%P!<%U%m!<$N@H<e@-$,$"$j$^$9!#7k2L$H$7(B
      $B$F!"1s3V$NBh;0<T$,G$0U$N%3!<%I$r<B9T$7$?$j!"(BWeb $B%V%i%&%6$r%/%i%C(B
      $B%7%e$5$;$?$j$9$k2DG=@-$,$"$j$^$9!#(B

      $BBP>]$H$J$k%P!<%8%g%s$O0J2<$NDL$j$G$9!#(B

      - ImageKit7 ActiveX FixNo.11 $B$*$h$S$=$l0JA0(B
      - ImageKit6 FixNo.60 $B$*$h$S$=$l0JA0(B
      - ImageKit5 FixNo.60 $B$*$h$S$=$l0JA0(B

      $B$3$NLdBj$O!"G[I[85$,Ds6!$9$k=$@5:Q$_$N%P!<%8%g%s$K(B ImageKit
      ActiveX $B%3%s%H%m!<%k$r99?7$9$k$3$H$G2r7h$7$^$9!#$J$*!"(BImageKit4 
      $B0JA0$N@=IJ$O%Y%s%@$,%5%]!<%H$r=*N;$7$F$$$k$?$a!"K\7o$NLdBj$r=$@5(B
      $B$7$?%P!<%8%g%s$K0\9T$9$k$3$H$r?d>)$7$^$9!#(B

    $B4XO"J8=q(B ($BF|K\8l(B)
      $B%K%e!<%H%s@55,EPO?%f!<%6@lMQ%5!<%S%9(B (ImageKit5)
      $B%$%a!<%8=hM}(BActiveX$B%3%s%]!<%M%s%H(B ImageKit5
      http://www.newtone.co.jp/supportik5.html

      $B%K%e!<%H%s@55,EPO?%f!<%6@lMQ%5!<%S%9(B (ImageKit6)
      $B%$%a!<%8=hM}%3%s%]!<%M%s%H(B ImageKit6
      http://www.newtone.co.jp/supportik6.html

      $B@55,EPO?%f!<%6@lMQ%5!<%S%9!J(BImageKit7 ActiveX$B!K(B
      $B%$%a!<%8=hM}%3%s%]!<%M%s%H(B ImageKit7 ActiveX
      http://www.newtone.co.jp/supportik7AX.html

$B!Z(B8$B![(BRuby $B$N(B CGI $B%i%$%V%i%j$K@H<e@-(B

    $B>pJs8;(B
      JP Vendor Status Notes JVN#84798830
      Ruby $B$N(B CGI $B%i%$%V%i%j(B cgi.rb $B$K$*$1$k%5!<%S%91?MQK832(B (DoS) $B$N@H<e@-(B
      http://jvn.jp/jp/JVN%2384798830/index.html

    $B35MW(B
      Ruby $B$NI8=`%i%$%V%i%j$G$"$k(B cgi.rb $B$K$O@H<e@-$,$"$j$^$9!#7k2L$H(B
      $B$7$F!"1s3V$NBh;0<T$,%5!<%S%91?MQK832(B (DoS) $B967b$r9T$&2DG=@-$,$"(B
      $B$j$^$9!#(B

      $BBP>]$H$J$k%P!<%8%g%s$O0J2<$NDL$j$G$9!#(B

      - Ruby 1.8.5 $B0JA0$N$9$Y$F$N%P!<%8%g%s!J(B1.8$B7O!K(B
      - 2006-12-04 $B0JA0$N$9$Y$F$N3+H/HG(B (1.9$B7O(B)

      $B$3$NLdBj$O!";HMQ$7$F$$$k(B OS $B$N%Y%s%@$dG[I[85$,Ds6!$9$k=$@5:Q$_$N(B
      $B%Q%C%1!<%8$K(B Ruby $B$r99?7$9$k$3$H$G2r7h$7$^$9!#>\:Y$K$D$$$F$O!"%Y(B
      $B%s%@$dG[I[85$N(B Web $B%Z!<%8$r;2>H$7$F$/$@$5$$!#(B

    $B4XO"J8=q(B ($BF|K\8l(B)
      $B$b$&0l$D$N(BCGI$B%i%$%V%i%j$N(BDoS$B@H<e@-$K$D$$$F(B
      http://www.ruby-lang.org/ja/news/2006/12/04/another-dos-vulnerability-in-cgi-library/

      $BFHN)9T@/K!?M(B $B>pJs=hM}?d?J5!9=(B $B%;%-%e%j%F%#%;%s%?!<(B
      JVN#84798830$B!V(BRuby$B!W$N(B CGI $B%i%$%V%i%j(B cgi.rb $B$K$*$1$k%5!<%S%91?MQK832(B(DoS)$B$N@H<e@-(B
      http://www.ipa.go.jp/security/vuln/documents/2006/JVN_84798830_Ruby.html

$B!Z(B9$B![%8%c%9%H%7%9%F%`$N@=IJ72$K@H<e@-(B

    $B>pJs8;(B
      JP Vendor Status Notes JVN#47272891
      $B2V;R$K$*$1$k%P%C%U%!%*!<%P!<%U%m!<$N@H<e@-(B
      http://jvn.jp/jp/JVN%2347272891/index.html

    $B35MW(B
      $B%8%c%9%H%7%9%F%`$N@=IJ72$G$"$k0lB@O:(B ($B0lB@O:%S%e!<%"4^$`(B)$B!"2V;R(B 
      ($B2V;R%S%e!<%"4^$`(B) $B$*$h$S;0;MO:$K$O@H<e@-$,$"$j$^$9!#7k2L$H$7$F!"(B
      $B1s3V$NBh;0<T$,G$0U$N%3!<%I$r<B9T$9$k2DG=@-$,$"$j$^$9!#(B

      $BBP>]$H$J$k@=IJ$*$h$S%P!<%8%g%s$O0J2<$NDL$j$G$9!#(B

      - $B0lB@O:(B2005
      - $B0lB@O:(B2004
      - $B0lB@O:(B $BJ8i:(B
      - $B2V;R(B2006
      - $B2V;R(B2005
      - $B2V;R(B2004
      - $B;0;MO:(B2005
      - $B0lB@O:(BLite2 /R.2
      - $B0lB@O:(BLite2

      - $B0lB@O:%S%e!<%"(B ($B%P!<%8%g%s(B 4.1.1.0 $B0JA0(B)
      - $B2V;R%S%e!<%"(B ($B%P!<%8%g%s(B 1.0.1.0 $B0JA0(B)

      $B>\:Y$K$D$$$F$O!"%Y%s%@$,Ds6!$9$k>pJs$r;2>H$7$F$/$@$5$$!#(B

      $B$3$NLdBj$O!"G[I[85$,Ds6!$9$k%"%C%W%G!<%H%b%8%e!<%k$rF3F~$9$k$3$H(B
      $B$G2r7h$7$^$9!#(B

    $B4XO"J8=q(B ($BF|K\8l(B)
      $B!V0lB@O:(B2005/2004$B!"2V;R(B2006/2005/2004$B!";0;MO:(B2005 $B%;%-%e%j%F%#99?7%b%8%e!<%k!W!"!V0lB@O:%S%e!<%"!W!"!V2V;R%S%e!<%"!W!"!V0lB@O:(BLite2 $B%;%-%e%j%F%#99?7%b%8%e!<%k!W$N8x3+(B
      http://www.justsystem.co.jp/info/pd6005.html

      $BFHN)9T@/K!?M(B $B>pJs=hM}?d?J5!9=(B $B%;%-%e%j%F%#%;%s%?!<(B
      JVN#47272891$B!V2V;R!W$K$*$1$k%P%C%U%!%*!<%P!<%U%m!<$N@H<e@-(B
      http://www.ipa.go.jp/security/vuln/documents/2006/JVN_47272891_hanako.html

$B!Z(B10$B![(BTikiWiki $B$K%/%m%9%5%$%H%9%/%j%W%F%#%s%0$N@H<e@-(B

    $B>pJs8;(B
      JP Vendor Status Notes JVN#38746816
      TikiWiki $B$K$*$1$k%/%m%9%5%$%H%9%/%j%W%F%#%s%0$N@H<e@-(B
      http://jvn.jp/jp/JVN%2338746816/index.html

    $B35MW(B
      TikiWiki $B$K$O%/%m%9%5%$%H%9%/%j%W%F%#%s%0$N@H<e@-$,$"$j$^$9!#7k(B
      $B2L$H$7$F!"1s3V$NBh;0<T$,%f!<%6$N%V%i%&%6>e$GG$0U$N%9%/%j%W%H$r<B(B
      $B9T$9$k2DG=@-$,$"$j$^$9!#(B

      $BBP>]$H$J$k%P!<%8%g%s$O0J2<$NDL$j$G$9!#(B

      - TikiWiki 1.9.5 $B$*$h$S$=$l0JA0(B

      $B$3$NLdBj$O!"G[I[85$,Ds6!$9$k=$@5:Q$_$N%P!<%8%g%s$K(B TikiWiki $B$r99(B
      $B?7$9$k$3$H$G2r7h$7$^$9!#(B

    $B4XO"J8=q(B ($BF|K\8l(B)
      $BFHN)9T@/K!?M(B $B>pJs=hM}?d?J5!9=(B $B%;%-%e%j%F%#%;%s%?!<(B
      JVN#38746816$B!V(BTikiWiki$B!W$K$*$1$k%/%m%9%5%$%H!&%9%/%j%W%F%#%s%0$N@H<e@-(B
      http://www.ipa.go.jp/security/vuln/documents/2006/JVN_38746816_TikiWiki.html

    $B4XO"J8=q(B ($B1Q8l(B)
      Downloading Tikiwiki
      http://tikiwiki.org/tiki-index.php?page=Download&bl

$B!Z(B11$B![$7$g$\$7$g$\F|5-%7%9%F%`(B (sns) $B$K%/%m%9%5%$%H%9%/%j%W%F%#%s%0$N@H<e@-(B

    $B>pJs8;(B
      JP Vendor Status Notes JVN#34830904
      $B$7$g$\$7$g$\F|5-%7%9%F%`(B (sns) $B$K$*$1$k%/%m%9%5%$%H%9%/%j%W%F%#%s%0$N@H<e@-(B
      http://jvn.jp/jp/JVN%2334830904/index.html

    $B35MW(B
      Web $BF|5-:n@.MQ%9%/%j%W%H$G$"$k$7$g$\$7$g$\F|5-%7%9%F%`(B (sns) $B$K(B
      $B$O!"%/%m%9%5%$%H%9%/%j%W%F%#%s%0$N@H<e@-$,$"$j$^$9!#7k2L$H$7$F!"(B
      $B1s3V$NBh;0<T$,%f!<%6$N%V%i%&%6>e$GG$0U$N%9%/%j%W%H$r<B9T$9$k2DG=(B
      $B@-$,$"$j$^$9!#(B

      $BBP>]$H$J$k%P!<%8%g%s$O0J2<$NDL$j$G$9!#(B

      - $B$7$g$\$7$g$\F|5-%7%9%F%`(B (sns) 3.11 $B$*$h$S$=$l0JA0(B

      $B$3$NLdBj$O!"G[I[85$,Ds6!$9$k=$@5:Q$_$N%P!<%8%g%s(B 3.12 $B$K$7$g$\$7$g(B
      $B$\F|5-%7%9%F%`(B (sns) $B$r%P!<%8%g%s%"%C%W$9$k$3$H$G2r7h$7$^$9!#(B

    $B4XO"J8=q(B ($BF|K\8l(B)
      Project Amateras
      http://amateras.sourceforge.jp/cgi-bin/fswiki/wiki.cgi

      $BFHN)9T@/K!?M(B $B>pJs=hM}?d?J5!9=(B $B%;%-%e%j%F%#%;%s%?!<(B
      JVN#34830904$B!V$7$g$\$7$g$\F|5-%7%9%F%`(B (sns)$B!W$K$*$1$k%/%m%9%5%$%H!&%9%/%j%W%F%#%s%0$N@H<e@-(B
      http://www.ipa.go.jp/security/vuln/documents/2006/JVN_34830904_sns.html


$B!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=(B
$B"#:#=5$N0l8}%a%b(B
$B!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=(B

$B!{56%*%s%i%$%s%7%g%C%T%s%0%5%$%H$KCm0U(B

      $B%*%s%i%$%s%7%g%C%T%s%0%5%$%H$d%*!<%/%7%g%s%5%$%H$rAu$C$?%5%$%H$K(B
      $B$h$C$F!">&IJBe6b$,qY$7<h$i$l$?$j!"%/%l%8%C%H%+!<%IHV9f$J$I$N5!L)(B
      $B>pJs$,Ep$^$l$?$j$9$kHo32$,H/@8$7$F$$$^$9!#%*%s%i%$%s%7%g%C%T%s%0(B
      $B%5%$%H$d%*!<%/%7%g%s%5%$%H$rMxMQ$9$k>l9g$K$O0J2<$NE@$KCm0U$7$F$/(B
      $B$@$5$$!#(B

      - SSL (https) $B$K$h$kEE;R=pL>$*$h$S7PO)$N0E9f2=$,9T$J$o$l$F$$$k$+(B
        $B3NG'(B

        $B5!L)>pJs$rAw?.$9$k%Z!<%8$K$*$$$F!"=pL>$,$J$$!"$^$?7PO)$N0E9f2=(B
        $B$,9T$J$o$l$F$$$J$$%5%$%H$OMxMQ$7$J$$$3$H$r$*4+$a$7$^$9!#(B

      - SSL $B%5!<%P>ZL@=q$NFbMF$KLdBj$,$J$$$+3NG'(B

        $B>ZL@=q<+BN$OE,@Z$JG'>Z6I$+$iH/9T$5$l$F$$$F$b!"K\Mh$N%5%$%H$r1?(B
        $B1D$7$F$$$k2q<R$H$OA4$/L54X78$N2q<R$N>ZL@=q$G$"$k>l9g$,$"$j$^$9!#(B
        $B$3$N$h$&$K!"%5%$%H$r1?1D$7$F$$$k2q<R$H>ZL@=q$K5-:\$5$l$?2q<R$H(B
        $B$N4X78$,L@3N$G$J$$>l9g$O!"$=$N%5%$%H$rMxMQ$7$J$$$3$H$r$*4+$a$7(B
        $B$^$9!#(B

      - $B%*%s%i%$%s$G;HMQ$9$k@lMQ%/%l%8%C%H%+!<%I$r=`Hw(B

        $BIaCJ;HMQ$9$k%/%l%8%C%H%+!<%I$H%*%s%i%$%s%7%g%C%T%s%0$J$I$G;HMQ(B
        $B$9$k%+!<%I$rJL$K$7!"8e<T$G;HMQ$9$k%+!<%I$N>e8B6b3[$rDc$a$K@_Dj(B
        $B$9$k$3$H$r$*4+$a$7$^$9!#$^$?!"@A5a=q$NL@:Y$r$3$^$a$K3NG'$9$k$3(B
        $B$H$r6/$/$*4+$a$7$^$9!#(B

      $B"($3$l$O(B JPCERT/CC REPORT 2005-12-14$B9f!V:#=5$N0l8}%a%b!W$N:F7G$G(B
        $B$9!#(B

    $B;29MJ88%(B ($BF|K\8l(B)
      JPCERT/CC REPORT 2005-12-14 [$B:#=5$N0l8}%a%b(B]
      $B56%*%s%i%$%s%7%g%C%T%s%0%5%$%H$KCm0U(B
      http://www.jpcert.or.jp/wr/2005/wr054901.txt


$B!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=(B
$B"#(BJPCERT/CC $B$+$i$N$*4j$$(B
$B!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=!=(B

$B!~K\%l%]!<%H$K4X$9$k$*Ld$$9g$o$;$O(B editor@jpcert.or.jp $B08$K$*4j$$CW$7$^(B
  $B$9!#$?$@$7!"(BJPCERT/CC $B$G$O!"Ds6!$9$k>pJs$K$D$$$F6qBNE*$JFbMF$=$N$b$N$K(B
  $B$D$$$F$N$4<ALd$K$O$*Ez$($G$-$J$$>l9g$b$"$j$^$9!#$^$?%P%C%/%J%s%P!<$O!"(B
  $B0J2<$N(B URL $B$+$i$4MxMQ$$$?$@$1$^$9!#(B

        http://www.jpcert.or.jp/wr/

$B!~K\%a!<%j%s%0%j%9%H$N9XFI?=9~$d9XFIDd;_!"$^$?EPO?$7$?EE;R%a!<%k%"%I%l%9(B
  $B$NJQ99$J$I$K$D$-$^$7$F$O!"0J2<$N(B URL $B$r$4;2>H$/$@$5$$!#(B

        http://www.jpcert.or.jp/announce.html

$B!~(BJPCERT/CC $B$X$N%;%-%e%j%F%#%$%s%7%G%s%H$NJs9pJ}K!$K$D$$$F$O0J2<$N(B URL
  $B$r$4;2>H$/$@$5$$!#(B

        http://www.jpcert.or.jp/form/

$B0J>e!#(B
__________

2006 (C) JPCERT/CC
-----BEGIN PGP SIGNATURE-----

iQCVAwUBRX9EE4x1ay4slNTtAQGDjgP+Ifz411aeiMIMQV2+WSpZSCm3RU3L2gk8
gQpsix+ttk7GmuZpZRc8r5AgYd1GHPtgveva6Z37EanbMdYF/Zs4o0U4M7YzIbKs
K1QM1q0NTKfm+FbcEAzK8yIfuCkicgk5Dle9GQmWXX8GjvpodKsuJJBSkPTza7w+
2cVUVPdjtoY=
=2u4v
-----END PGP SIGNATURE-----