|
[Japanese]
|
JVNDB-2023-003592
|
Multiple vulnerabilities in JTEKT ELECTRONICS Kostac PLC Programming Software
|
|
Kostac PLC Programming Software provided by JTEKT ELECTRONICS CORPORATION contains multiple vulnerabilities listed below.
* Double free (CWE-415) - CVE-2023-41374
* Use-after-free (CWE-416) - CVE-2023-41375
Michael Heinzl reported these vulnerabilities to JPCERT/CC.
JPCERT/CC coordinated with the developer.
|
|
CVSS V3 Severity:
Base Metrics 7.8 (High) [Other]
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
The above CVSS base scores have been assigned for CVE-2023-41374
|
CVSS V3 Severity:
Base Metrics:7.8 (High) [Other]
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
The above CVSS base scores have been assigned for CVE-2023-41375
|
|
|
JTEKT ELECTRONICS CORPORATION
- Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.11.0 and earlier
|
|
|
Arbitrary code may be executed by having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier because the issue exists in parsing of KPP project files.
|
|
[Update the software]
Update Kostac PLC Programming Software to the latest version according to the information provided by the developer.
The developer released the following versions that contain fixes for these vulnerabilities.
* Kostac PLC Programming Software Version 1.6.12.0 and above
The latest update can be obtained from the developer's website listed below.
* PLC - Download | JTEKT ELECTRONICS CORPORATION
[Apply workaround]
The developer states that Kostac PLC Programming Software Version 1.6.10.0 or later implements the function which prevents a project file alteration. Therefore, to mitigate the impact of these vulnerabilities, a project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier needs to be saved again using Kostac PLC Programming Software Version 1.6.10.0 or later.
|
|
JTEKT ELECTRONICS CORPORATION
|
|
- Double Free(CWE-415) [Other]
- Use After Free(CWE-416) [Other]
|
|
- CVE-2023-41374
- CVE-2023-41375
|
|
- JVN : JVNVU#95282683
|
|
- [2023/09/13]
Web page was published
|
