|
[Japanese]
|
JVNDB-2017-010584
|
AssetView and AssetView PLATINUM contain multiple vulnerabilities
|
|
AssetView and AssetView PLATINUM provided by Hammock Corporation contain 2 vulnerabilities listed below.
* Use of Hard-coded Cryptographic Key (CWE-321) - CVE-2017-10866
* Improper Input Validation (CWE-20) - CVE-2017-10867
Muneaki Nishimura of of Recruit Technologies Co.,Ltd. RED TEAM reported this vulnerability to JPCERT/CC.
JPCERT/CC coordinated with the developer.
|
|
CVSS V3 Severity:
Base Metrics 8.8 (High) [IPA Score]
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
CVSS V2 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
- Access Vector: Local
- Access Complexity: Low
- Authentication: Single Instance
- Confidentiality Impact: Complete
- Integrity Impact: Complete
- Availability Impact: Complete
The above CVSS base scores have been assigned for CVE-2017-10866.
|
CVSS V3 Severity:
Base Metrics:
7.8 (High) [IPA Score]
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
CVSS V2 Severity:Base Metrics:
6.0 (Medium)
[IPA Score]
- Access Vector: Local
- Access Complexity: High
- Authentication: Single
- Confidentiality Impact: Complete
- Integrity Impact: Complete
- Availability Impact: Complete
The above CVSS base scores have been assigned for CVE-2017-10867.
|
|
|
Hammock Corporation
- AssetView Ver.7.0.0 to Ver. 9.2.3
- AssetView PLATINUM Ver. 1.1.0 to 6.2.2
|
For details, refer to the information provided by the developer.
|
|
A user who knows the cryptographic key used in the system can conduct followings:
* Perform an arbitrary operation to an arbitrary client terminal when Remote Control function is enabled - CVE-2017-10866
* Alter information that is temporarily saved on a client terminal before being sent to the server, and then execute an arbitray SQL query to the server of AssetView or the server of AssetView PLATINUM - CVE-2017-10867
|
|
[Update the Software]
Update the software to the latest version according to the information provided by the developer.
[Apply the Patch]
Apply the security patch "AssetView Encryption Module Hotfix" in the case updating the software is not an option.
For more information, refer to the information provided by the developer.
|
|
Hammock Corporation
|
|
- Improper Input Validation(CWE-20) [IPA Evaluation]
- Use of Hard-coded Cryptographic Key(CWE-321) [IPA Evaluation]
|
|
- CVE-2017-10866
- CVE-2017-10867
|
|
- JVN : JVNVU#91625548
|
|
- [2018/01/12]
Web page was published
|
