JVN#06337557
Installer and self-extracting archive containing the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system may insecurely load Dynamic Link Libraries
Overview
The installer and the self-extracting archive containing the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system may insecurely load Dynamic Link Libraries.
Products Affected
- The installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.0.2 and earlier, distributed till June 20, 2017.
- The self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system Ver3.0.2 and earlier, distributed till June 20, 2017.
Description
The installer and the self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427).
Impact
Arbitrary code may be executed with the privilege of the user invoking the installer or the self-extracting archive.
Solution
Use the latest self-extracting archive and invoke the installer carefully
Use the latest self-extracting archive according to the information provided by the developer.
New self-extracting archive has been created with the latest Lhaplus archiver which is not affected by this issue, and it was released on June 20, 2017.
When invoking the installer extracted from the self-extracting archive, make sure that no malicious DLL exists in the same directory.
Re-installation of the application is not necessary, because this issue affects the installer only.
Vendor Status
| Vendor | Link |
| Ministry of Land, Infrastructure, Transport and Tourism, Japan | Government Buildings Department, MLIT: DenshiSeikabutsuSakuseiShienKensa System ver3.0 |
| Vulnerability Announcement |
References
-
Japan Vulnerability Notes JVNTA#91240916
Insecure DLL Loading and Command Execution Issues on Many Windows Application Programs
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Comment
This analysis assumes that the user is tricked into placing a malicious DLL file prepared by an attacker in a specific folder.
Credit
Eili Masami of Tachibana Lab. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2017-2231 |
| JVN iPedia |
JVNDB-2017-000158 |
Update History
- 2017/07/03
- Fixed a link under the section [Vendor Status]
- 2017/07/11
- Information under the section [Products Affected] was modified.