Published:2023/08/07  Last Updated:2023/08/31

JVN#42527152
"FFRI yarai" and "FFRI yarai Home and Business Edition" handle exceptional conditions improperly

Overview

"FFRI yarai" and "FFRI yarai Home and Business Edition" provided by FFRI Security, Inc. handle exceptional conditions improperly. Their OEM products are affected too.

Products Affected

  • FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0
  • FFRI yarai Home and Business Edition version 1.4.0
The developer states that the OEM products of "FFRI yarai" or "FFRI yarai Home and Business Edition" are affected, too.
  • Soliton Systems K.K.
    • InfoTrace Mark II Malware Protection (Mark II Zerona) versions 3.0.1 to 3.2.2
    • Zerona / Zerona PLUS versions 3.2.32 to 3.2.36
  • NEC Corporation
    • ActSecure χ versions 3.4.0 to 3.4.6 and 3.5.0
  • SOURCENEXT CORPORATION
    • Dual Safe Powered by FFRI yarai version 1.4.1
  • Sky Co., Ltd.
    • EDR Plus Pack (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0)
    • EDR Plus Pack Cloud (Bundled FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0)

Description

"FFRI yarai" and "FFRI yarai Home and Business Edition" provided by FFRI Security, Inc. handle exceptional conditions improperly (CWE-703).
When the product's Windows Defender management feature is enabled, and Microsoft Defender detects some files matching specific conditions as a threat, the affected product may fail to handle this situation properly and stop working.

Impact

The affected product may stop working, and remain stopped for 15 minutes in maximum.
Note that, even in such a situation, Microsoft Defender keeps working.

The developer states that the product can be recovered by either of the following.

  • Restart the system where the product is running
  • Wait for automatic recovery (15 minutes maximum)

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.
The following versions are provided to address the vulnerability:

  • FFRI Security, Inc.
    • FFRI yarai versions 3.4.7 or 3.5.3
    • FFRI yarai Home and Business Edition version 1.4.2
  • Soliton Systems K.K.
    • InfoTrace Mark II Malware Protection (Mark II Zerona) version 3.2.4
  • NEC Corporation
    • ActSecure χ version 3.5.3
  • SOURCENEXT CORPORATION
    • Dual Safe Powered by FFRI yarai version 1.4.2
  • Sky Co., Ltd.
    • EDR Plus Pack (Bundled FFRI yarai versions 3.4.7 or 3.5.3)
    • EDR Plus Pack Cloud (Bundled FFRI yarai versions 3.4.7 or 3.5.3)
Apply the Workaround
The following workaround may mitigate the impact of this vulnerability.
  • Disable the Windows Defender management feature
For more information, refer to the information provided by the developer.

Vendor Status

Vendor Link
FFRI Security, Inc. FFRI yarai Improper Check or Handling of Exceptional Conditions (Text in Japanese)
Soliton Systems K.K. A possible suspension vulnerability found in Zerona (Text in Japanese)
NEC Corporation ActSecureχ client Improper Check or Handling of Exceptional Conditions (Text in Japanese, login required)
SOURCENEXT CORPORATION Vulnerability and fix completed notices regarding "Dual Safe Powered by FFRI yarai" (Text in Japanese)
Sky Co., Ltd. Vulnerability on FFRI yarai bundled with EDR Plus Pack and EDR Plus Pack Cloud (CVE-2023-39341) (Text in Japanese)

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Base Score: 4.3
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:N/AC:M/Au:N/C:N/I:N/A:P
Base Score: 4.3
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Comment

The analysis assumes that Windows Defender management feature is enabled.
'User Interaction(UI)' is evaluated as 'Required' (UI:R), considering the attack scenario where a user is directed to open a certain file to trigger the detection.

Credit

FFRI Security, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and FFRI Security, Inc. coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2023-39341
JVN iPedia JVNDB-2023-000080

Update History

2023/08/31
Information under the section [Solution] was updated.