[Japanese]

JVNDB-2024-000028

Multiple vulnerabilities in SKYSEA Client View

Overview

SKYSEA Client View provided by Sky Co.,LTD. is an Enterprise IT Asset Management Tool.
SKYSEA Client View contains multiple vulnerabilities listed below.

* Improper access control in the specific folder (CWE-276) - CVE-2024-21805
* Improper access control in the resident process (CWE-749) - CVE-2024-24964

CVE-2024-21805
Ken Kitahara of LAC Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

CVE-2024-24964
Ruslan Sayfiev, and Denis Faiustov of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to Sky Co.,LTD. and coordinated. Sky Co.,LTD. and JPCERT/CC published respective advisories in order to notify users of the solutions through JVN.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.8 (High) [IPA Score]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS V2 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
  • Access Vector: Local
  • Access Complexity: Low
  • Authentication: Single Instance
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
The above CVSS base scores have been assigned for CVE-2024-24964

CVSS V3 Severity:
Base Metrics 3.3 (Low) [IPA Score]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None
CVSS V2 Severity:
Base Metrics 1.7 (Low) [IPA Score]
  • Access Vector: Local
  • Access Complexity: Low
  • Authentication: Single
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
Assuming an attack scenario in which a logged-in attacker with some non-administrative privilege puts a crafted DLL file in a specific folder, "Integrity (I)" is treated as the primary impact, whereas "Confidentiality (C)" and "Availability (A)" are treated as secondary. In addition, if the vulnerability evaluate including secondary impact, the evaluation of "Confidentiality Impact(C)", "Integrity Impact(I)", and "Availability Impact(A)" are "High (H)".
The above CVSS base scores have been assigned for CVE-2024-21805
Affected Products


Sky Co., LTD.
  • SKYSEA Client View versions from Ver.16.100 prior to Ver.19.3 (CVE-2024-21805)
  • SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2 (CVE-2024-24964)

<<2024/7/29 Update>> When this advisory was first published on March 3, 2024, the range of the affected versions were described as "from Ver.16.100 prior to Ver.19.2". After that, Ver.19.3 was released with further updates.
Impact

* An arbitrary file may be placed in the specific folder by a user who can log in to the PC where the product's Windows client is installed. In case the file is a specially crafted DLL file, arbitrary code may be executed with SYSTEM privilege - CVE-2024-21805
* An arbitrary process may be executed with SYSTEM privilege by a user who can log in to the PC where the product's Windows client is installed - CVE-2024-24964
Solution

For CVE-2024-21805
[Update the software]
Update the software to the latest version according to the information provided by the developer.
The developer has released SKYSEA Client View Ver.19.3 that addresses these vulnerabilities.

[Apply the patch]
For SKYSEA Client View Ver.17.0 to Ver.19.2, the developer has released the patches fixing these vulnerabilities.
For more details, refer to the information provided by the developer.

<<2024/7/29 Update>>
When this advisory was first published on March 3, 2024, the range of the affected versions were described as "Ver.16.100 prior to Ver.19.2". After that, Ver.19.3 was released with futher modification.

For CVE-2024-24964
[Update the software]
Update the software to the latest version according to the information provided by the developer.
The developer has released SKYSEA Client View Ver.19.2 that addresses these vulnerabilities.

[Apply the patch]
For SKYSEA Client View Ver.17.0 to Ver.19.101, the developer has released the patches fixing these vulnerabilities.

For more details, refer to the information provided by the developer.
Vendor Information

Sky Co., LTD.
CWE (What is CWE?)

  1. Permissions(CWE-264) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2024-21805
  2. CVE-2024-24964
References

  1. JVN : JVN#54451757
Revision History

  • [2024/03/07]
      Web page was published
  • [2024/07/29]
      CVSS Severity was modified
      Affected Products : Product version was modified
      Affected Products : Content was added
      Solution was modified

Date Public2024/03/07
Date First Published2024/03/07
Date Last Updated2024/07/29