Microsoft Windows动画光标畸形ANI头结构远程栈溢出漏洞(MS07-017)

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接： 临时解决方法：

* 以纯文本格式读取邮件

* 禁用预览栏

* 配置Windows资源管理器使用Windows传统风格的文件夹：

打开Windows资源管理器

在"工具"菜单中选择"文件夹"选项

在"任务"部分选择"使用Windows传统风格的文件夹"

厂商补丁：

Microsoft

---------

Microsoft已经为此发布了一个安全公告(MS07-017)以及相应补丁:

MS07-017：Vulnerabilities in GDI Could Allow Remote Code Execution (925902)

链接：

http://www.microsoft.com/technet/security/Bulletin/MS07-017.mspx?pf=true

来源: TA07-093A

名称: TA07-093A

链接:http://www.us-cert.gov/cas/techalerts/TA07-093A.html

来源: TA07-089A

名称: TA07-089A

链接:http://www.us-cert.gov/cas/techalerts/TA07-089A.html

来源: VU#191609

名称: VU#191609

链接:http://www.kb.cert.org/vuls/id/191609

来源: TA07-100A

名称: TA07-100A

链接:http://www.us-cert.gov/cas/techalerts/TA07-100A.html

来源: XF

名称: windows-ani-code-execution(33301)

链接:http://xforce.iss.net/xforce/xfdb/33301

来源: BUGTRAQ

名称: 20070402 More information on ZERT patch for ANI 0day

链接:http://www.securityfocus.com/archive/1/archive/1/464459/100/100/threaded

来源: BUGTRAQ

名称: 20070331 RE: [Full-disclosure] 0-day ANI vulnerability in Microsoft Windows(CVE-2007-0038)

链接:http://www.securityfocus.com/archive/1/archive/1/464342/100/0/threaded

来源: BUGTRAQ

名称: 20070331 Re: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)

链接:http://www.securityfocus.com/archive/1/archive/1/464340/100/0/threaded

来源: BUGTRAQ

名称: 20070330 Re: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)

链接:http://www.securityfocus.com/archive/1/archive/1/464339/100/0/threaded

来源: BUGTRAQ

名称: 20070330 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)

链接:http://www.securityfocus.com/archive/1/archive/1/464269/100/0/threaded

来源: MS

名称: MS07-017

链接:http://www.microsoft.com/technet/security/Bulletin/ms07-017.mspx

来源: VUPEN

名称: ADV-2007-1215

链接:http://www.frsirt.com/english/advisories/2007/1215

来源: MISC

链接:http://www.determina.com/security_center/security_advisories/securityadvisory_0day_032907.asp

来源: SECUNIA

名称: 24659

链接:http://secunia.com/advisories/24659

来源: MILW0RM

名称: 3634

链接:http://milw0rm.com/exploits/3634

来源: FULLDISC

名称: 20070330 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)

链接:http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0470.html

来源: HP

名称: SSRT071354

链接:http://www.securityfocus.com/archive/1/archive/1/466186/100/200/threaded

来源: BUGTRAQ

名称: 20070402 MS announces out-of-band patch for ANI 0day

链接:http://www.securityfocus.com/archive/1/archive/1/464460/100/100/threaded

来源: OSVDB

名称: 33629

链接:http://www.osvdb.org/33629

来源: SREASON

名称: 2542

链接:http://securityreason.com/securityalert/2542

来源: oval:org.mitre.oval:def:1854

名称: oval:org.mitre.oval:def:1854

链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1854