JVN#55365709
AL-Mail32 vulnerable to denial-of-service (DoS)
Overview
AL-Mail32 provided by CREAR Corporation contains a denial-of-service (DoS) vulnerability.
Products Affected
- AL-Mail32 Version1.13c and earlier
Description
AL-Mail32 provided by CREAR Corporation is an email client for Windows. AL-Mail32 contains a denial-of-service (DoS) vulnerability due to a flaw in processing attachments.
Impact
Processing an attachment with a specially crafted file name may cause the software to become unresponsive.
Solution
Update the Software
Update to the latest version according to the information provided by the developer.
References
JPCERT/CC Addendum
During the coordination process, IPA and JPCERT/CC determined that this case was not a vulnerability under the "Information Security Early Warning Partnership". However, this JVN advisory has been published coinciding with the vendor advisory.
Vulnerability Analysis by JPCERT/CC
Analyzed on 2015.02.20 (CVSS Base Metrics)
| Measures | Severity | Description | ||
|---|---|---|---|---|
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) | A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such a vulnerability is often termed "remotely exploitable". |
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) | The access conditions are somewhat specialized. |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) | Authentication is not required to exploit the vulnerability. |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) | There is no impact to the confidentiality of the system. |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) | There is no impact to the integrity of the system. |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) | There is reduced performance or interruptions in resource availability. |
Base Score:4.3
Credit
Yosuka HASEGAWA of NetAgent Co.,Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert | |
| JPCERT Reports | |
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2015-0879 |
| JVN iPedia |
JVNDB-2015-000021 |