[Japanese]

JVNDB-2021-000078

The installers of multiple Sony products may insecurely load Dynamic Link Libraries

Overview

The installers of multiple Sony products contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427).

Shogo Kumamaru of LAC Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.8 (High) [IPA Score]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS V2 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
Affected Products


Sony Corporation
  • HAP Music Transfer installer Ver.1.3.0 and prior
  • Sony Audio USB Driver installer V1.10 and prior

Impact

Arbitrary code may be executed with the privilege of the user invoking the installer.
Solution

[Use the latest installer by following the latest guidance]
Use the latest installer along with the latest installation guidance provided by the developer.

Users who already have installed the software do not need to re-install, because this issue affects the installers only.
Vendor Information

Sony Corporation
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2021-20793
References

  1. JVN : JVN#80288258
  2. JVN : JVNTA#91240916
  3. National Vulnerability Database (NVD) : CVE-2021-20793
Revision History

  • [2021/08/24]
      Web page was published

Date Public2021/08/24
Date First Published2021/08/24
Date Last Updated2021/08/24