CVE-2014-2003 JustSystems JUST Online Update, as used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules, which allows remote attackers to spoof modules and execute...
HighCVSS 7.6
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
JustSystems JUST Online Update, as used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules, which allows remote attackers to spoof modules and execute arbitrary code via a crafted signature.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| justsystems ichitaro | <= 2014 | No fix listed |
| justsystems ichitaro | = 10 | No fix listed |
| justsystems ichitaro | = 11 | No fix listed |
| justsystems ichitaro | = 12 | No fix listed |
| justsystems ichitaro | = 13 | No fix listed |
| justsystems ichitaro | = 2004 | No fix listed |
| justsystems ichitaro | = 2005 | No fix listed |
| justsystems ichitaro | = 2006 | No fix listed |
| justsystems ichitaro | = 2007 | No fix listed |
| justsystems ichitaro | = 2008 | No fix listed |
| justsystems ichitaro | = 2009 | No fix listed |
| justsystems ichitaro | = 2010 | No fix listed |
| justsystems ichitaro | = 2011 | No fix listed |
| justsystems ichitaro | = 2012 | No fix listed |
| justsystems ichitaro | = 2013 | No fix listed |
| justsystems just online update | All versions | No fix listed |
References
- JVN#50129191 third-party-advisory
- JVNDB-2014-000053 third-party-advisory
- www.ipa.go.jp
- www.justsystems.com vendor-advisory