|
[Japanese]
|
JVNDB-2025-000033
|
Improper pattern file validation in i-FILTER optional feature 'Anti-Virus & Sandbox'
|
|
The optional feature 'Anti-Virus & Sandbox' of i-FILTER provided by Digital Arts Inc. validates pattern files improperly.
- Improper pattern file validation (CWE-348) - CVE-2025-47149
Digital Arts Inc. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Digital Arts Inc. coordinated under the Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 5.3 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
|
CVSS v4 Severity
Base Metrics: 6.9 (Medium) [IPA Score]
- Attack Vector (AV): Network
- Attack Complexity (AC): Low
- Attack Requirements (AT): None
- Privileges Required (PR): None
- User Interaction (UI): None
Vulnerable System Impact Metrics
- Confidentiality (VC): None
- Integrity (VI): Low
- Availability (VA): None
Subsequent System Impact Metrics
- Confidentiality (SC): None
- Integrity (SI): None
- Availability (SA): None
|
|
|
Digital Arts Inc.
- i-FILTER Ver.10.50R01 to Ver.10.67R02
|
According to the developer, D-SPA Ver.4 using i-FILTER is affected as well.
Note that the product is affected only when the optional feature 'Anti-Virus & Sandbox' is being used.
|
|
The product may treat an unauthorized pattern file as an authorized.
If the product uses a specially crafted pattern file, information in the server where the product is running may be retrieved, and/or cause a denial of service (DoS) condition.
|
|
[Update the Software]
Update the software to the latest version according to the information provided by the developer.
The developer has released the following version to address this vulnerability.
- i-FILTER Ver.10.67R03 or later
For more details, refer to the information provided by the developer.
|
|
Digital Arts Inc.
|
|
- No Mapping(CWE-Other) [IPA Evaluation]
|
|
- CVE-2025-47149
|
|
- JVN : JVN#68079883
|
|
- [2025/05/23]
Web page was published
|
