cnvd-2017-29219
Vulnerability from cnvd
Title
Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program不可信搜索路径漏洞
Description
Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program是日本Agency for Natural Resources and Energy of Ministry，Trade and Industry（METI）的一款石油行业基本统计报表数据输入程序。Installer是其中的一个安装程序。 Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program中的安装程序存在不可信搜索路径漏洞。攻击者可借助目录下的恶意DLL利用该漏洞获取权限。
Severity
高
Patch Name
Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program不可信搜索路径漏洞的补丁
Patch Description
Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program是日本Agency for Natural Resources and Energy of Ministry，Trade and Industry（METI）的一款石油行业基本统计报表数据输入程序。Installer是其中的一个安装程序。 Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program中的安装程序存在不可信搜索路径漏洞。攻击者可借助目录下的恶意DLL利用该漏洞获取权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://www.enecho.meti.go.jp/statistics/petroleum_and_lpgas/oil_enterprise/001/

Reference
http://jvn.jp/en/jp/JVN71104430/
Impacted products
Name
Agency for Natural Resources and Energy of Ministry of Economy,Trade and Industry (METI) Installer of Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program
Show details on source website

To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-10822"
    }
  },
  "description": "Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program\u662f\u65e5\u672cAgency for Natural Resources and Energy of Ministry\uff0cTrade and Industry\uff08METI\uff09\u7684\u4e00\u6b3e\u77f3\u6cb9\u884c\u4e1a\u57fa\u672c\u7edf\u8ba1\u62a5\u8868\u6570\u636e\u8f93\u5165\u7a0b\u5e8f\u3002Installer\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u5b89\u88c5\u7a0b\u5e8f\u3002\r\n\r\nShin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program\u4e2d\u7684\u5b89\u88c5\u7a0b\u5e8f\u5b58\u5728\u4e0d\u53ef\u4fe1\u641c\u7d22\u8def\u5f84\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u76ee\u5f55\u4e0b\u7684\u6076\u610fDLL\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u6743\u9650\u3002",
  "discovererName": "Eili Masami of Tachibana Lab.",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.enecho.meti.go.jp/statistics/petroleum_and_lpgas/oil_enterprise/001/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-29219",
  "openTime": "2017-10-09",
  "patchDescription": "Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program\u662f\u65e5\u672cAgency for Natural Resources and Energy of Ministry\uff0cTrade and Industry\uff08METI\uff09\u7684\u4e00\u6b3e\u77f3\u6cb9\u884c\u4e1a\u57fa\u672c\u7edf\u8ba1\u62a5\u8868\u6570\u636e\u8f93\u5165\u7a0b\u5e8f\u3002Installer\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u5b89\u88c5\u7a0b\u5e8f\u3002\r\n\r\nShin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program\u4e2d\u7684\u5b89\u88c5\u7a0b\u5e8f\u5b58\u5728\u4e0d\u53ef\u4fe1\u641c\u7d22\u8def\u5f84\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u76ee\u5f55\u4e0b\u7684\u6076\u610fDLL\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program\u4e0d\u53ef\u4fe1\u641c\u7d22\u8def\u5f84\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Agency for Natural Resources and Energy of Ministry of Economy,Trade and Industry (METI) Installer of Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program"
  },
  "referenceLink": "http://jvn.jp/en/jp/JVN71104430/",
  "serverity": "\u9ad8",
  "submitTime": "2017-08-18",
  "title": "Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program\u4e0d\u53ef\u4fe1\u641c\u7d22\u8def\u5f84\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.