JVN#84995847
SKYSEA Client View vulnerable to arbitrary code execution
Critical
Overview
SKYSEA Client View contains an arbitrary code execution vulnerability.
Products Affected
- SKYSEA Client View Ver.11.221.03 and earlier
Description
SKYSEA Client View provided by Sky Co., LTD. is an Enterprise IT Asset Management Tool. SKYSEA Client View agent program contains an issue in processing authentication on the TCP communication with the management console program, which allows an attacker to execute an arbitrary code on the client PC.
Attacks exploiting this vulnerability have been observed in the wild.
Impact
SKYSEA Client View agent program may be manipulated by a remote attacker. As a result, arbitrary code may be executed on the client PC.
Solution
Update the Software
Apply the latest update according to the information provided by the developer.
The developer has released SKYSEA Client View Ver.11.300.08h which contains a fix for this vulnerability.
Apply the Patch
Apply the patch according to the information provided by the developer.
The patch is available from the developer's support page (registered users only).
Apply a Workaround
The following workaround may mitigate the affects of this vulnerability.
- Restrict access to the SKYSEA Client View agent program
Vendor Status
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Sky Co., LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Sky Co., LTD. coordinated under the Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
JPCERT-AT-2016-0051 Alert regarding vulnerability (CVE-2016-7836) in SKYSEA Client View |
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2016-7836 |
| JVN iPedia |
JVNDB-2016-000249 |
Update History
- 2016/12/22
- Information under the section "Other Information" was updated.
- 2016/12/26
- Information under the section "Vendor Information" was modified.
- 2017/03/10
- Information under the section "Vendor Information" was updated.