Electronic Tendering and Bid Opening System DLL Loading Remote Code Execution Vulnerability

Bugtraq ID:	98725
Class:	Design Error
CVE:	CVE-2017-2178
Remote:	Yes
Local:	No
Published:	May 25 2017 12:00AM
Updated:	May 25 2017 12:00AM
Credit:	Eili Masami of Tachibana Lab.
Vulnerable:	Acquisition, Technology & Logistics Agency Electronic Tendering and Bid Opening System 0
Not Vulnerable:

Electronic Tendering and Bid Opening System DLL Loading Remote Code Execution Vulnerability

Electronic Tendering and Bid Opening System is prone to a remote code-execution vulnerability.

A remote attacker can leverage this issue to execute arbitrary code in the context of the affected application.

Electronic Tendering and Bid Opening System DLL Loading Remote Code Execution Vulnerability

Attackers must trick a user into opening a file on a remote WebDAV or SMB share to exploit this issue.

A general exploit technique has been documented by TheLeader and H.D. Moore for the Metasploit Project; please see the references for more information.

Electronic Tendering and Bid Opening System DLL Loading Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Electronic Tendering and Bid Opening System DLL Loading Remote Code Execution Vulnerability

References:

• Acquisition, Technology & Logistics Agency Homepage (Mod.Go)
  
• Exploiting DLL Hijacking Flaws (hdm)
  
• More information about the DLL Preloading remote attack vector (Microsoft)
  
• Electronic bidding in central procurement (equipments etc. and services) (Mod.Go)
  
• JVN#75514460: Installer of electronic tendering and bid opening system provided (JPCERT)