CVE-2016-7818
Summary
| CVE | CVE-2016-7818 |
|---|---|
| State | PUBLISHED |
| Assigner | jpcert |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-06-09 16:29:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory. |
Risk And Classification
Primary CVSS: v3.0 7.8 HIGH from [email protected]
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Problem Types: CWE-264 | Untrusted search path vulnerability
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 7.8 | HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
CVSS v3.0 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Japan Pension Service | Device Data Encryption Program | 1.00 | All | All | All |
| Application | Japan Pension Service | Specification Check Program | 9.00 | All | All | All |
| Application | Japan Pension Service | Todokesho Creation Program | 15.00 | All | All | All |
| Application | Japan Pension Service | Todokesho Print Program | 5.00 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Japan Pension Service | Intstaller For Specification Check Programsocial Insurance | affected Ver. 9.00 and earlier that was available prior to October 17, 2016 | Not specified |
| CNA | Japan Pension Service | Intstaller For TODOKESHO Print Program | affected Ver. 5.00 and earlier that was available prior to October 17, 2016 | Not specified |
| CNA | Japan Pension Service | Intstaller For Device Data Encryption Program | affected Ver. 1.00 and earlier that was available prior to October 17, 2016 | Not specified |
| CNA | Japan Pension Service | Intstaller For TODOKESHO Creation Program | affected Ver. 15.00 and earlier that was available prior to October 17, 2016 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 届書データにパスワードを設定する場合｜日本年金機構 | af854a3a-2127-422b-91ae-364da2661108 | www.nenkin.go.jp | Patch, Vendor Advisory |
| 届出システムを自社開発または市販ソフトを使用する場合｜日本年金機構 | af854a3a-2127-422b-91ae-364da2661108 | www.nenkin.go.jp | Patch, Vendor Advisory |
| 日本年金機構が提供する届書作成プログラムを利用する場合｜日本年金機構 | af854a3a-2127-422b-91ae-364da2661108 | www.nenkin.go.jp | Patch, Vendor Advisory |
| 紙の様式に準じて出力する場合｜日本年金機構 | af854a3a-2127-422b-91ae-364da2661108 | www.nenkin.go.jp | Patch, Vendor Advisory |
| Multiple Japan Pension Service Products CVE-2016-7818 DLL Loading Local Code Execution Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| JVN#08868688: The installers of multiple Japan Pension Service software may insecurely load Dynamic Link Libraries | af854a3a-2127-422b-91ae-364da2661108 | jvn.jp | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.