JVNDB-2008-000086

BlackJumboDog authentication bypass vulnerability

BlackJumboDog from SapporoWorks contains an authentication bypass vulbnerability.

BlackJumboDog from SapporoWorks is a software that provides server functions for an intranet. BlackJumboDog contains an authentication bypass vulnerability.

Tsuyoshi Ishibashi of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Base Metrics: 5.0 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Low
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: None
• Availability Impact: None

SapporoWorks

• BlackJumboDog Ver4.2.2 and earlier

A remote attacker can bypass authentication of BlackJumboDog. As a result, the attacker gains access to the server and information may be disclosed.

[Update the Software]
Update to the latest version according to the information provided by the developers.

SapporoWorks

• SapporoWorks : Security Issue in the authentication mechanism for the BJD Web server (Japanese)

1. JVN : JVN#98063934
2. National Vulnerability Database (NVD) : CVE-2008-5721
3. Common Vulnerabilities and Exposures (CVE) : CVE-2008-5721
4. Common Weakness Enumeration (CWE) : Insufficient Authentication (CWE-287) [IPA Evaluation]
5. JVN iPedia (Japanese) : JVNDB-2008-000086

[2008/12/25]
  Web page published