JVNDB-2014-000053

JustSystems Online Update Program bundled with JustSystems products vulnerable to arbitrary code execution

"JUST Online Update" and "JUST Online Update for J-License and the management tools" that are bundled with multiple JustSystems products contain a flaw that allows the update program to be executed even if the signature of an update module is invalid.
Please note that this is a flaw in the online update program, not a flaw in each software itself.

All the products that bundle the following update program are affected.

JustSystems Corporation

• JUST Online Update (for an individual user)
• JUST Online Update for J-License and management tools (for a corporate user)

A wide range of products are affected. For more information, please refer to the developer's web site.

If a user execute a crafted update module, arbitrary code may be executed.

[Apply the Update]
Update "JUST Online Update" and "JUST Online Update for J-License and management tools" according to the information provided by the developer.

For more information, please refer to the developer's website.

JustSystems Corporation

• JustSystems Corporation : [JS140002] Vulnerability in Online Update Program contains in multiple Justsystems products (in Japanese)

1. No Mapping(CWE-noinfo) [IPA Evaluation]

1. CVE-2014-2003

1. JVN : JVN#50129191
2. National Vulnerability Database (NVD) : CVE-2014-2003
3. IPA SECURITY ALERTS : About arbitrary code execution vulnerability of JustSystems Online Update Program bundled with JustSystems products (JVN#50129191) (in Japanese)

• [2014/06/11]
    Web page was published
  [2014/06/17]
    References : Content was added