Microsoft Internet Explorer Zone拒绝服务漏洞

BUGTRAQ ID: 24744

CNCAN ID:CNCAN-2007070410
Microsoft Internet Explorer是一款流行的WEB浏览器。

Microsoft Internet Explorer处理使用不同参数(子域)的域名存在问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。

问题存在于当在Intranet区域和限制区域中使用不同字符[* ,.]，浏览器处理带有不同参数的[sub domains]的域名会出现奇怪的行为，打开这些WEB站点会导致过量使用CPU而造成拒绝服务攻击。

Microsoft Internet Explorer 6.0 SP2
Microsoft Internet Explorer 6.0 SP1
Microsoft Internet Explorer 6.0

• Citrix ICA Client for Windows 4.0 SP6a
• Microsoft Windows 2000 Advanced Server SP2
• Microsoft Windows 2000 Advanced Server SP2
• Microsoft Windows 2000 Advanced Server SP1
• Microsoft Windows 2000 Advanced Server SP1
• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Datacenter Server SP2
• Microsoft Windows 2000 Datacenter Server SP2
• Microsoft Windows 2000 Datacenter Server SP1
• Microsoft Windows 2000 Datacenter Server SP1
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows 2000 Professional SP2
• Microsoft Windows 2000 Professional SP2
• Microsoft Windows 2000 Professional SP1
• Microsoft Windows 2000 Professional SP1
• Microsoft Windows 2000 Professional
• Microsoft Windows 2000 Professional
• Microsoft Windows 2000 Server SP2
• Microsoft Windows 2000 Server SP2
• Microsoft Windows 2000 Server SP1
• Microsoft Windows 2000 Server SP1
• Microsoft Windows 2000 Server
• Microsoft Windows 2000 Server
• Microsoft Windows 2000 Terminal Services SP2
• Microsoft Windows 2000 Terminal Services SP2
• Microsoft Windows 2000 Terminal Services SP1
• Microsoft Windows 2000 Terminal Services SP1
• Microsoft Windows 2000 Terminal Services
• Microsoft Windows 2000 Terminal Services
• Microsoft Windows 98
• Microsoft Windows 98
• Microsoft Windows 98SE
• Microsoft Windows 98SE
• Microsoft Windows ME
• Microsoft Windows ME
• Microsoft Windows NT 4.0 SP6a
• Microsoft Windows NT Enterprise Server 4.0 SP6a
• Microsoft Windows NT Enterprise Server 4.0 SP6a
• Microsoft Windows NT Server 4.0 SP6a
• Microsoft Windows NT Server 4.0 SP6a
• Microsoft Windows NT Workstation 4.0 SP6a
• Microsoft Windows NT Workstation 4.0 SP6a

• Microsoft Windows Server 2003 Datacenter Edition
• Microsoft Windows Server 2003 Datacenter Edition
• Microsoft Windows Server 2003 Datacenter Edition Itanium 0
• Microsoft Windows Server 2003 Enterprise Edition
• Microsoft Windows Server 2003 Enterprise Edition
• Microsoft Windows Server 2003 Enterprise Edition Itanium 0
• Microsoft Windows Server 2003 Enterprise Edition Itanium 0
• Microsoft Windows Server 2003 Standard Edition
• Microsoft Windows Server 2003 Standard Edition
• Microsoft Windows Server 2003 Web Edition
• Microsoft Windows Server 2003 Web Edition
• Microsoft Windows XP Home
• Microsoft Windows XP Home
• Microsoft Windows XP Professional
• Microsoft Windows XP Professional
  Microsoft Internet Explorer 7.0 beta3
  Microsoft Internet Explorer 7.0 beta2
  Microsoft Internet Explorer 7.0 beta1
  Microsoft Internet Explorer 7.0
• Microsoft Windows Vista Ultimate
• Microsoft Windows Vista Ultimate
• Microsoft Windows Vista Home Premium
• Microsoft Windows Vista Home Premium
• Microsoft Windows Vista Home Basic
• Microsoft Windows Vista Home Basic
• Microsoft Windows Vista Enterprise
• Microsoft Windows Vista Enterprise
• Microsoft Windows Vista Business
• Microsoft Windows Vista Business
• Microsoft Windows Vista 0
• Microsoft Windows Vista 0
• Microsoft Windows Vista 0

目前没有解决方案提供：

<a href=“http://www.microsoft.com/windows/ie/” target=“_blank”>http://www.microsoft.com/windows/ie/</a>