Details of VAR-201005-0436

ID

VAR-201005-0436

TITLE

XMAP3 Arbitrary Code Execution Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2010-001427

DESCRIPTION

An arbitrary code execution vulnerability exists in the system installed with XMAP3/Web, or it may experience unexpected shutdown of Internet Explorer. The same issues exist in the Web browser testing tool, a web system development feature that comes with XMAP3/NET and XMAP3/Enterprise Edition.A remote attacker could execute arbitrary code on the affected system. Failed exploit attempts will result in a denial-of-service condition. ---------------------------------------------------------------------- Looking for a job? Secunia is hiring skilled researchers and talented developers. Internet Explorer. The vulnerability is reported in the following products: * XMAP3/Web version 4 * XMAP3/Web for Cosminexus * XMAP3/NET version 4 * XMAP3/Enterprise Edition version 4 SOLUTION: Apply patches. Please see the vendor's advisory for a patch matrix. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: Hitachi: http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-004/index.html OTHER REFERENCES: JVN: http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-001427.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.62

sources: JVNDB: JVNDB-2010-001427 // CNVD: CNVD-2010-0898 // BID: 40218 // PACKETSTORM: 89616

IOT TAXONOMY

category:

['ICS', 'Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2010-0898

AFFECTED PRODUCTS

vendor:	hitachi	model:	xmap3/enterprise edition	scope:	eq	version:	version 4	Trust: 0.8
vendor:	hitachi	model:	xmap3/net	scope:	eq	version:	version 4	Trust: 0.8
vendor:	hitachi	model:	xmap3/web	scope:	eq	version:	for cosminexus	Trust: 0.8
vendor:	hitachi	model:	xmap3/web	scope:	eq	version:	version 4	Trust: 0.8
vendor:	hitachi	model:	xmap3/enterprise edition	scope:	eq	version:	4.x	Trust: 0.6
vendor:	hitachi	model:	xmap3/net	scope:	eq	version:	4.x	Trust: 0.6
vendor:	hitachi	model:	xmap3/web	scope:	eq	version:	4.x	Trust: 0.6
vendor:	hitachi	model:	xmap3/web for cosminexus xmap3/web for cosminexus	scope:	-	version:	-	Trust: 0.6
vendor:	hitachi	model:	xmap3/web for cosminexus	scope:	eq	version:	0	Trust: 0.3
vendor:	hitachi	model:	xmap3/web	scope:	eq	version:	0	Trust: 0.3
vendor:	hitachi	model:	xmap3/net	scope:	eq	version:	0	Trust: 0.3
vendor:	hitachi	model:	xmap3/enterprise edition	scope:	eq	version:	0	Trust: 0.3

sources: CNVD: CNVD-2010-0898 // BID: 40218 // JVNDB: JVNDB-2010-001427

CVSS

SEVERITY

CVSSV2

CVSSV3

IPA:	JVNDB-2010-001427
value:	HIGH
Trust: 0.8

IPA:	JVNDB-2010-001427
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

sources: JVNDB: JVNDB-2010-001427

THREAT TYPE

network

Trust: 0.3

sources: BID: 40218

TYPE

Unknown

Trust: 0.3

sources: BID: 40218

CONFIGURATIONS

sources: JVNDB: JVNDB-2010-001427

PATCH

title:	HS10-004	url:	http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs10-004/index.html	Trust: 0.8
title:	Hitachi XMAP3 product code execution patch	url:	https://www.cnvd.org.cn/patchinfo/show/407	Trust: 0.6

sources: CNVD: CNVD-2010-0898 // JVNDB: JVNDB-2010-001427

EXTERNAL IDS

db:	HITACHI	id:	HS10-004	Trust: 1.0
db:	JVNDB	id:	JVNDB-2010-001427	Trust: 0.9
db:	CNVD	id:	CNVD-2010-0898	Trust: 0.6
db:	BID	id:	40218	Trust: 0.3
db:	SECUNIA	id:	39853	Trust: 0.3
db:	PACKETSTORM	id:	89616	Trust: 0.1

sources: CNVD: CNVD-2010-0898 // BID: 40218 // JVNDB: JVNDB-2010-001427 // PACKETSTORM: 89616

REFERENCES

url:	http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs10-004/index.htmlhttp	Trust: 0.6
url:	http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs10-004/index.html	Trust: 0.4
url:	http://www.hitachi.com/index.html	Trust: 0.3
url:	http://jvndb.jvn.jp/en/contents/2010/jvndb-2010-001427.html	Trust: 0.1
url:	http://secunia.com/company/jobs/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/39853/	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: CNVD: CNVD-2010-0898 // BID: 40218 // PACKETSTORM: 89616

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 40218

SOURCES

db:	CNVD	id:	CNVD-2010-0898
db:	BID	id:	40218
db:	JVNDB	id:	JVNDB-2010-001427
db:	PACKETSTORM	id:	89616

LAST UPDATE DATE

2022-05-17T02:10:51.468000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2010-0898	date:	2010-05-19T00:00:00
db:	BID	id:	40218	date:	2010-04-21T00:00:00
db:	JVNDB	id:	JVNDB-2010-001427	date:	2010-05-18T00:00:00

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2010-0898	date:	2010-05-19T00:00:00
db:	BID	id:	40218	date:	2010-04-21T00:00:00
db:	JVNDB	id:	JVNDB-2010-001427	date:	2010-05-18T00:00:00
db:	PACKETSTORM	id:	89616	date:	2010-05-18T15:00:31