CVE-2014-2003

JustSystems JUST Online Update, as used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules, which allows remote attackers to spoof modules and execute arbitrary code via a crafted signature.

CVSS v2.0 7.6 HIGH

7.6^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:H/Au:N/C:C/I:C/A:C

Exploitability : 4.9 / Impact : 10.0

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://jvn.jp/en/jp/JVN50129191/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000053
http://www.ipa.go.jp/security/ciadr/vul/20140611-jvn.html
http://www.justsystems.com/jp/info/js14002.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:justsystems:ichitaro::::::::
	cpe:2.3:a:justsystems:ichitaro:10:::::::*
	cpe:2.3:a:justsystems:ichitaro:11:::::::*
	cpe:2.3:a:justsystems:ichitaro:12:::::::*
	cpe:2.3:a:justsystems:ichitaro:13:::::::*
	cpe:2.3:a:justsystems:ichitaro:2004:::::::*
	cpe:2.3:a:justsystems:ichitaro:2005:::::::*
	cpe:2.3:a:justsystems:ichitaro:2006:::::::*
	cpe:2.3:a:justsystems:ichitaro:2006:-:government:::::*
	cpe:2.3:a:justsystems:ichitaro:2007:::::::*
	cpe:2.3:a:justsystems:ichitaro:2007:-:government:::::*
	cpe:2.3:a:justsystems:ichitaro:2008:::::::*
	cpe:2.3:a:justsystems:ichitaro:2008:-:government:::::*
	cpe:2.3:a:justsystems:ichitaro:2009:::::::*
	cpe:2.3:a:justsystems:ichitaro:2009:-:government:::::*
	cpe:2.3:a:justsystems:ichitaro:2009:-:trial:::::*
	cpe:2.3:a:justsystems:ichitaro:2010:::::::*
	cpe:2.3:a:justsystems:ichitaro:2010:-:government:::::*
	cpe:2.3:a:justsystems:ichitaro:2011:::::::*
	cpe:2.3:a:justsystems:ichitaro:2011:-:sou:::::*
	cpe:2.3:a:justsystems:ichitaro:2012:-:shou:::::*
	cpe:2.3:a:justsystems:ichitaro:2013:-:gen:::::*
	cpe:2.3:a:justsystems:ichitaro:2013:-:gen_trial:::::*
	cpe:2.3:a:justsystems:just_online_update:-:::::::*

History

No history.

Information

Published : 2014-06-16 14:55

Updated : 2023-12-10 11:31

NVD link : CVE-2014-2003

Mitre link : CVE-2014-2003

CVE.ORG link : CVE-2014-2003

JSON object : View

Products Affected

justsystems

ichitaro
just_online_update

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2014-2003", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-06-16T14:55:05.457", "references": [{"url": "http://jvn.jp/en/jp/JVN50129191/index.html", "source": "vultures@jpcert.or.jp"}, {"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000053", "source": "vultures@jpcert.or.jp"}, {"url": "http://www.ipa.go.jp/security/ciadr/vul/20140611-jvn.html", "source": "vultures@jpcert.or.jp"}, {"url": "http://www.justsystems.com/jp/info/js14002.html", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "JustSystems JUST Online Update, as used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules, which allows remote attackers to spoof modules and execute arbitrary code via a crafted signature."}, {"lang": "es", "value": "JustSystems JUST Online Update, utilizado en Ichitaro hasta 2014 y otros productos, no valida debidamente firmas de m\u00f3dulos de actualizaci\u00f3n, lo que permite a atacantes remotos falsificar m\u00f3dulos y ejecutar c\u00f3digo arbitrario a trav\u00e9s de una firma manipulada."}], "lastModified": "2014-06-16T16:43:25.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:justsystems:ichitaro:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4144834-782B-492F-B935-F036A5C26902", "versionEndIncluding": "2014"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64910A2D-4EFD-4435-B021-A47E5CA10901"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3255951-1684-4F78-9AA8-0721D43C4E75"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF1D2069-D1F4-4F31-8B78-9768F43EF847"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D65FA81-F110-4C21-8BD4-1A14BFFC7730"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2004:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFAE853E-5415-4B31-A873-E74E7C66C52F"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2005:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "471FA5F8-8EC2-4FEB-93E0-B838F81BD472"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2006:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E7E7611-56FC-4379-99FE-8D42046FA9C8"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2006:-:government:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA38365F-0FB9-4570-8A38-4FCC9AADA267"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2007:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A749FA56-6DE2-48A4-902C-6EB7E6575BA3"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2007:-:government:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A5C721C-CA01-4C6A-AC7C-C07FC3A333D3"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2008:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B8FAFF2-94AD-4C8B-8B10-57651DEA6191"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2008:-:government:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25F1AF4E-E4EC-4E66-B532-002A8512916F"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2009:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12205BDB-6DD6-46B8-891B-E4EAAB8F3588"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2009:-:government:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BC34189-32FE-4C8E-A87E-731C622ECBC0"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2009:-:trial:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5B023D0-C271-45B2-82D9-9AD4D800893E"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2010:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9C3EDDB-E30F-45BA-94C4-5C917283971E"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2010:-:government:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6881ACA2-0625-4E3F-8136-D20E627BFC9E"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2011:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A4975EC-E1DB-45C0-AFF6-C3E97F273332"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2011:-:sou:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47047585-7145-40D5-8FA2-B1B542CF6AC8"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2012:-:shou:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EE20B2C-6630-4362-9438-91571BD531B6"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2013:-:gen:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DF9AE8E-A943-49AF-A507-4423ADC8796C"}, {"criteria": "cpe:2.3:a:justsystems:ichitaro:2013:-:gen_trial:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35A0240E-138D-4CE3-9D9E-30AEE34F9238"}, {"criteria": "cpe:2.3:a:justsystems:just_online_update:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96F6290F-EB66-4423-8F54-436BBC547547"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}