Vulnerability Description
JustSystems JUST Online Update, as used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules, which allows remote attackers to spoof modules and execute arbitrary code via a crafted signature.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Justsystems | Ichitaro | <= 2014 |
| Justsystems | Just Online Update | - |
Related Weaknesses (CWE)
References
- http://jvn.jp/en/jp/JVN50129191/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000053
- http://www.ipa.go.jp/security/ciadr/vul/20140611-jvn.html
- http://www.justsystems.com/jp/info/js14002.htmlVendor Advisory
- http://jvn.jp/en/jp/JVN50129191/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000053
- http://www.ipa.go.jp/security/ciadr/vul/20140611-jvn.html
- http://www.justsystems.com/jp/info/js14002.htmlVendor Advisory
FAQ
What is CVE-2014-2003?
CVE-2014-2003 is a vulnerability with a CVSS score of 7.6 (HIGH). JustSystems JUST Online Update, as used in Ichitaro through 2014 and other products, does not properly validate signatures of update modules, which allows remote attackers to spoof modules and execute...
How severe is CVE-2014-2003?
CVE-2014-2003 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-2003?
Check the references section above for vendor advisories and patch information. Affected products include: Justsystems Ichitaro, Justsystems Just Online Update.