jvndb-2014-000053
Vulnerability from jvndb
Published
2014-06-11 12:22
Modified
2014-06-17 16:25
Summary
JustSystems Online Update Program bundled with JustSystems products vulnerable to arbitrary code execution
Details
"JUST Online Update" and "JUST Online Update for J-License and the management tools" that are bundled with multiple JustSystems products contain a flaw that allows the update program to be executed even if the signature of an update module is invalid.
Please note that this is a flaw in the online update program, not a flaw in each software itself.
References
| ▼ | Type | URL |
|---|---|---|
| JVN | http://jvn.jp/en/jp/JVN50129191/index.html | |
| CVE | //cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2003 | |
| NVD | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2003 | |
| IPA SECURITY ALERTS | http://www.ipa.go.jp/security/ciadr/vul/20140611-jvn.html | |
| No Mapping(CWE-noinfo) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| JustSystems Corporation | JUST Online Update |
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000053.html",
"dc:date": "2014-06-17T16:25+09:00",
"dcterms:issued": "2014-06-11T12:22+09:00",
"dcterms:modified": "2014-06-17T16:25+09:00",
"description": "\"JUST Online Update\" and \"JUST Online Update for J-License and the management tools\" that are bundled with multiple JustSystems products contain a flaw that allows the update program to be executed even if the signature of an update module is invalid.\r\nPlease note that this is a flaw in the online update program, not a flaw in each software itself.",
"link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000053.html",
"sec:cpe": {
"#text": "cpe:/a:justsystems:just_online_update",
"@product": "JUST Online Update",
"@vendor": "JustSystems Corporation",
"@version": "2.2"
},
"sec:cvss": {
"@score": "7.6",
"@severity": "High",
"@type": "Base",
"@vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"@version": "2.0"
},
"sec:identifier": "JVNDB-2014-000053",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN50129191/index.html",
"@id": "JVN#50129191",
"@source": "JVN"
},
{
"#text": "//cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2003",
"@id": "CVE-2014-2003",
"@source": "CVE"
},
{
"#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2003",
"@id": "CVE-2014-2003",
"@source": "NVD"
},
{
"#text": "http://www.ipa.go.jp/security/ciadr/vul/20140611-jvn.html",
"@id": "About arbitrary code execution vulnerability of JustSystems Online Update Program bundled with JustSystems products (JVN#50129191)",
"@source": "IPA SECURITY ALERTS"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-noinfo",
"@title": "No Mapping(CWE-noinfo)"
}
],
"title": "JustSystems Online Update Program bundled with JustSystems products vulnerable to arbitrary code execution"
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.