JVN#96681653
WinSparkle issue where registry value is not validated
Overview
WinSparkle contains an issue where the directory or file path specified in a certain registry key is not validated.
Products Affected
- Applications that use WinSparkle versions prior to 0.5.3
Description
When an application that uses WinSparkle is launched, it checks the directory used by WinSparkle for temporary files and deletes any temporary files. This directory path is specified in a registry key.
In a situation where an attacker has modified the specific registry value used by this library, and a user launches an application that uses WinSparkle, an unintended directory or file may be deleted.
Impact
Effects vary depending on the application. An arbitrary directory or file may be deleted with the privileges of the application.
Solution
Update the software
Update to the latest version according to the information provided by the developer.
Vendor Status
| Vendor | Link |
| WinSparkle | WinSparkle |
| Release Version 0.5.3 | |
| Verify UpdateTempDir isn't maliciously modified - GitHub | |
| Wireshark Foundation | Wireshark |
| Wireshark 2.2.3 and 2.0.9 Released |
References
-
Japan Vulnerability Note JVN#90813656
Wireshark for Windows issue where an arbitrary file may be deleted
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Takashi Yoshikawa of Mitsui Bussan Secure Directions, Inc. reported this issue to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2016-7838 |
| JVN iPedia |
JVNDB-2016-000251 |