CVE-2017-2157
Summary
| CVE | CVE-2017-2157 |
|---|---|
| State | PUBLISHED |
| Assigner | jpcert |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-05-12 18:29:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)", The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier that were available until April 27, 2017 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory. |
Risk And Classification
Primary CVSS: v3.0 7.3 HIGH from [email protected]
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Problem Types: CWE-426 | Untrusted search path vulnerability
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 7.3 | HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
CVSS v3.0 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:L/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Jpki | The Public Certification Service For Individuals | - | All | All | All |
| Application | Jpki | The Public Certification Service For Individuals | All | All | All | All |
| Application | Jpki | The Public Certification Service For Individuals | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Japan Agency For Local Authority Information Systems | Installer For The Public Certification Service For Individuals The JPKI Users Software For Windows 7 And Later | affected Ver3.1 and earlier that was available until April 27, 2017 | Not specified |
| CNA | Japan Agency For Local Authority Information Systems | Installer For The Public Certification Service For Individuals The JPKI Users Software For Windows Vista | affected available until April 27, 2017 | Not specified |
| CNA | Japan Agency For Local Authority Information Systems | Installer For The Public Certification Service For Individuals The JPKI Users Software | affected Ver2.6 and earlier that was available until April 27, 2017 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Windowsをご利用の方 | 公的個人認証サービス ポータルサイト | af854a3a-2127-422b-91ae-364da2661108 | www.jpki.go.jp | Patch, Vendor Advisory |
| JVN#39605485: The installer of The Public Certification Service for Individuals "The JPKI user's software" may insecurely load Dynamic Link Libraries | af854a3a-2127-422b-91ae-364da2661108 | jvn.jp | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.