Lucene search

JpcertCVE-2017-10850

HistorySep 01, 2017 - 2:29 p.m.

CVE-2017-10850

2017-09-0114:29:00

CWE-426

jpcert

web.nvd.nist.gov

security

vulnerability

untrusted search path

art ex driver

apeosport

docucentre

dll

code signing

privilege escalation

nvd

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

27.0%

JSON

Untrusted search path vulnerability in Installers of ART EX Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271 (Timestamp of code signing is before 12 Apr 2017 02:04 UTC.), PostScript? Driver + Additional Feature Plug-in + PPD File for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271 (Timestamp of code signing is before 12 Apr 2017 02:10 UTC.), XPS Print Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271 (Timestamp of code signing is before 3 Nov 2017 23:48 UTC.), ART EX Direct FAX Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271 (Timestamp of code signing is before 26 May 2017 07:44 UTC.), Setting Restore Tool for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271 (Timestamp of code signing is before 25 Aug 2015 08:51 UTC.) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

Affected configurations

Nvd

Node

fujifilmapeosport-viMatchc2271

fujifilmapeosport-viMatchc3371

fujifilmapeosport-viMatchc4471

fujifilmapeosport-viMatchc5571

fujifilmapeosport-viMatchc6671

fujifilmapeosport-viMatchc7771

Node

fujifilmdocucentre-viMatchc2271

fujifilmdocucentre-viMatchc3371

fujifilmdocucentre-viMatchc4471

fujifilmdocucentre-viMatchc5571

fujifilmdocucentre-viMatchc6671

fujifilmdocucentre-viMatchc7771

VendorProductVersionCPE
fujifilmapeosport-vic2271cpe:2.3:a:fujifilm:apeosport-vi:c2271:*:*:*:*:*:*:*
fujifilmapeosport-vic3371cpe:2.3:a:fujifilm:apeosport-vi:c3371:*:*:*:*:*:*:*
fujifilmapeosport-vic4471cpe:2.3:a:fujifilm:apeosport-vi:c4471:*:*:*:*:*:*:*
fujifilmapeosport-vic5571cpe:2.3:a:fujifilm:apeosport-vi:c5571:*:*:*:*:*:*:*
fujifilmapeosport-vic6671cpe:2.3:a:fujifilm:apeosport-vi:c6671:*:*:*:*:*:*:*
fujifilmapeosport-vic7771cpe:2.3:a:fujifilm:apeosport-vi:c7771:*:*:*:*:*:*:*
fujifilmdocucentre-vic2271cpe:2.3:a:fujifilm:docucentre-vi:c2271:*:*:*:*:*:*:*
fujifilmdocucentre-vic3371cpe:2.3:a:fujifilm:docucentre-vi:c3371:*:*:*:*:*:*:*
fujifilmdocucentre-vic4471cpe:2.3:a:fujifilm:docucentre-vi:c4471:*:*:*:*:*:*:*
fujifilmdocucentre-vic5571cpe:2.3:a:fujifilm:docucentre-vi:c5571:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fujifilm	apeosport-vi	c2271	cpe:2.3:a:fujifilm:apeosport-vi:c2271:::::::*
fujifilm	apeosport-vi	c3371	cpe:2.3:a:fujifilm:apeosport-vi:c3371:::::::*
fujifilm	apeosport-vi	c4471	cpe:2.3:a:fujifilm:apeosport-vi:c4471:::::::*
fujifilm	apeosport-vi	c5571	cpe:2.3:a:fujifilm:apeosport-vi:c5571:::::::*
fujifilm	apeosport-vi	c6671	cpe:2.3:a:fujifilm:apeosport-vi:c6671:::::::*
fujifilm	apeosport-vi	c7771	cpe:2.3:a:fujifilm:apeosport-vi:c7771:::::::*
fujifilm	docucentre-vi	c2271	cpe:2.3:a:fujifilm:docucentre-vi:c2271:::::::*
fujifilm	docucentre-vi	c3371	cpe:2.3:a:fujifilm:docucentre-vi:c3371:::::::*
fujifilm	docucentre-vi	c4471	cpe:2.3:a:fujifilm:docucentre-vi:c4471:::::::*
fujifilm	docucentre-vi	c5571	cpe:2.3:a:fujifilm:docucentre-vi:c5571:::::::*

Rows per page:

1-10 of 121

CNA Affected

[
  {
    "product": "Installer of ART EX Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271",
    "vendor": "Fuji Xerox Co.,Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Timestamp of code signing is before 12 Apr 2017 02:04 UTC"
      }
    ]
  },
  {
    "product": "Installer of ART EX Driver for DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271",
    "vendor": "Fuji Xerox Co.,Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Timestamp of code signing is before 12 Apr 2017 02:04 UTC"
      }
    ]
  },
  {
    "product": "Installer of PostScript? Driver + Additional Feature Plug-in + PPD File for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271",
    "vendor": "Fuji Xerox Co.,Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Timestamp of code signing is before 12 Apr 2017 02:10 UTC"
      }
    ]
  },
  {
    "product": "Installer of PostScript? Driver + Additional Feature Plug-in + PPD File for DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271",
    "vendor": "Fuji Xerox Co.,Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Timestamp of code signing is before 12 Apr 2017 02:10 UTC"
      }
    ]
  },
  {
    "product": "Installer of XPS Print Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271",
    "vendor": "Fuji Xerox Co.,Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Timestamp of code signing is before 3 Nov 2017 23:48 UTC"
      }
    ]
  },
  {
    "product": "Installer of XPS Print Driver for DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271",
    "vendor": "Fuji Xerox Co.,Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Timestamp of code signing is before 3 Nov 2017 23:48 UTC"
      }
    ]
  },
  {
    "product": "Installer of ART EX Direct FAX Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271",
    "vendor": "Fuji Xerox Co.,Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Timestamp of code signing is before 26 May 2017 07:44 UTC"
      }
    ]
  },
  {
    "product": "Installer of ART EX Direct FAX Driver for DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271",
    "vendor": "Fuji Xerox Co.,Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Timestamp of code signing is before 26 May 2017 07:44 UTC"
      }
    ]
  },
  {
    "product": "Installer of Setting Restore Tool for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271",
    "vendor": "Fuji Xerox Co.,Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Timestamp of code signing is before 25 Aug 2015 08:51 UTC"
      }
    ]
  },
  {
    "product": "Installer of Setting Restore Tool for DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271",
    "vendor": "Fuji Xerox Co.,Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Timestamp of code signing is before 25 Aug 2015 08:51 UTC"
      }
    ]
  }
]

References

www.fujixerox.co.jp/company/news/notice/2017/0831_rectification_work.html

jvn.jp/en/jp/JVN09769017/index.html

Social References

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

27.0%

JSON

Related for CVE-2017-10850