Vulnerability-Lookup

CVE-2016-7818 (GCVE-0-2016-7818)

Vulnerability from cvelistv5 – Published: 2017-06-09 16:00 – Updated: 2024-08-06 02:04

Summary

Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

Severity ?

No CVSS data available.

CWE

Untrusted search path vulnerability

Assigner

jpcert

References

URL

Tags

	http://www.nenkin.go.jp/denshibenri/setsumei/2015…	x_refsource_CONFIRM
	http://www.nenkin.go.jp/denshibenri/setsumei/2014…	x_refsource_CONFIRM
	http://www.nenkin.go.jp/denshibenri/setsumei/0104.html	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/94616	vdb-entryx_refsource_BID
	http://www.nenkin.go.jp/denshibenri/setsumei/2015…	x_refsource_CONFIRM
	https://jvn.jp/en/jp/JVN08868688/index.html	third-party-advisoryx_refsource_JVN

Impacted products

Vendor

Product

Version

Japan Pension Service

Intstaller for Specification check program(social insurance)

Affected: Ver. 9.00 and earlier that was available prior to October 17, 2016

Japan Pension Service	Intstaller for TODOKESHO print program	Affected: Ver. 5.00 and earlier that was available prior to October 17, 2016
Japan Pension Service	Intstaller for Device data encryption program	Affected: Ver. 1.00 and earlier that was available prior to October 17, 2016
Japan Pension Service	Intstaller for TODOKESHO creation program	Affected: Ver. 15.00 and earlier that was available prior to October 17, 2016

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:04:56.077Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.nenkin.go.jp/denshibenri/setsumei/0104.html"
          },
          {
            "name": "94616",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94616"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck"
          },
          {
            "name": "JVN#08868688",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN08868688/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Intstaller for Specification check program(social insurance)",
          "vendor": "Japan Pension Service",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 9.00 and earlier that was available prior to October 17, 2016"
            }
          ]
        },
        {
          "product": "Intstaller for TODOKESHO print program",
          "vendor": "Japan Pension Service",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 5.00 and earlier that was available prior to October 17, 2016"
            }
          ]
        },
        {
          "product": "Intstaller for Device data encryption program",
          "vendor": "Japan Pension Service",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 1.00 and earlier that was available prior to October 17, 2016"
            }
          ]
        },
        {
          "product": "Intstaller for TODOKESHO creation program",
          "vendor": "Japan Pension Service",
          "versions": [
            {
              "status": "affected",
              "version": "Ver. 15.00 and earlier that was available prior to October 17, 2016"
            }
          ]
        }
      ],
      "datePublic": "2016-12-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Untrusted search path vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-12T09:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.nenkin.go.jp/denshibenri/setsumei/0104.html"
        },
        {
          "name": "94616",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94616"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck"
        },
        {
          "name": "JVN#08868688",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN08868688/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2016-7818",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Intstaller for Specification check program(social insurance)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Ver. 9.00 and earlier that was available prior to October 17, 2016"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Intstaller for TODOKESHO print program",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Ver. 5.00 and earlier that was available prior to October 17, 2016"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Intstaller for Device data encryption program",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Ver. 1.00 and earlier that was available prior to October 17, 2016"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Intstaller for TODOKESHO creation program",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Ver. 15.00 and earlier that was available prior to October 17, 2016"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Japan Pension Service"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Untrusted search path vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html",
              "refsource": "CONFIRM",
              "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html"
            },
            {
              "name": "http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html",
              "refsource": "CONFIRM",
              "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html"
            },
            {
              "name": "http://www.nenkin.go.jp/denshibenri/setsumei/0104.html",
              "refsource": "CONFIRM",
              "url": "http://www.nenkin.go.jp/denshibenri/setsumei/0104.html"
            },
            {
              "name": "94616",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94616"
            },
            {
              "name": "http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck",
              "refsource": "CONFIRM",
              "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck"
            },
            {
              "name": "JVN#08868688",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN08868688/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2016-7818",
    "datePublished": "2017-06-09T16:00:00",
    "dateReserved": "2016-09-09T00:00:00",
    "dateUpdated": "2024-08-06T02:04:56.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:japan_pension_service:device_data_encryption_program:1.00:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B2EE2251-2F1A-44FE-94E0-94C75200ED2F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:japan_pension_service:specification_check_program:9.00:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4038181E-5454-417C-AAE7-C8FD3A8EAEB0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:japan_pension_service:todokesho_creation_program:15.00:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"14C4E1CC-9E90-4E0D-823B-0B2E9EA2FE23\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:japan_pension_service:todokesho_print_program:5.00:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9D55DFBC-CFE6-43C6-8A61-848FE0BCE8CB\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad de ruta (path) de b\\u00fasqueda no segura en Instalador para programa de comprobaci\\u00f3n Specification (social insurance) versi\\u00f3n 9.00 y anteriores, programa de impresi\\u00f3n de TODOKESHO versi\\u00f3n 5.00 y anteriores, programa de cifrado de datos de Device versi\\u00f3n 1.00 y anteriores, y programa de creaci\\u00f3n de TODOKESHO versi\\u00f3n 15.00 y anteriores disponibles antes del 17 de octubre de 2016, permite a los atacantes remotos alcanzar privilegios por medio de un archivo DLL de tipo caballo de Troya en un directorio no especificado.\"}]",
      "id": "CVE-2016-7818",
      "lastModified": "2024-11-21T02:58:32.193",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2017-06-09T16:29:00.797",
      "references": "[{\"url\": \"http://www.nenkin.go.jp/denshibenri/setsumei/0104.html\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/94616\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://jvn.jp/en/jp/JVN08868688/index.html\", \"source\": \"vultures@jpcert.or.jp\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.nenkin.go.jp/denshibenri/setsumei/0104.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/94616\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://jvn.jp/en/jp/JVN08868688/index.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}]",
      "sourceIdentifier": "vultures@jpcert.or.jp",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2016-7818\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2017-06-09T16:29:00.797\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de ruta (path) de b\u00fasqueda no segura en Instalador para programa de comprobaci\u00f3n Specification (social insurance) versi\u00f3n 9.00 y anteriores, programa de impresi\u00f3n de TODOKESHO versi\u00f3n 5.00 y anteriores, programa de cifrado de datos de Device versi\u00f3n 1.00 y anteriores, y programa de creaci\u00f3n de TODOKESHO versi\u00f3n 15.00 y anteriores disponibles antes del 17 de octubre de 2016, permite a los atacantes remotos alcanzar privilegios por medio de un archivo DLL de tipo caballo de Troya en un directorio no especificado.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:japan_pension_service:device_data_encryption_program:1.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2EE2251-2F1A-44FE-94E0-94C75200ED2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:japan_pension_service:specification_check_program:9.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4038181E-5454-417C-AAE7-C8FD3A8EAEB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:japan_pension_service:todokesho_creation_program:15.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14C4E1CC-9E90-4E0D-823B-0B2E9EA2FE23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:japan_pension_service:todokesho_print_program:5.00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D55DFBC-CFE6-43C6-8A61-848FE0BCE8CB\"}]}]}],\"references\":[{\"url\":\"http://www.nenkin.go.jp/denshibenri/setsumei/0104.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/94616\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://jvn.jp/en/jp/JVN08868688/index.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.nenkin.go.jp/denshibenri/setsumei/0104.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/94616\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://jvn.jp/en/jp/JVN08868688/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}"
  }
}

GHSA-6J3F-X2F3-WHQ9

Vulnerability from github – Published: 2022-05-17 02:40 – Updated: 2022-05-17 02:40

Details

Severity ?

7.8 (High)


                  
                    CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2016-7818"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-09T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.",
  "id": "GHSA-6j3f-x2f3-whq9",
  "modified": "2022-05-17T02:40:32Z",
  "published": "2022-05-17T02:40:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7818"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN08868688/index.html"
    },
    {
      "type": "WEB",
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/0104.html"
    },
    {
      "type": "WEB",
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html"
    },
    {
      "type": "WEB",
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html"
    },
    {
      "type": "WEB",
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/94616"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2016-7818

Vulnerability from fkie_nvd - Published: 2017-06-09 16:29 - Updated: 2025-04-20 01:37

Severity ?

7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
vultures@jpcert.or.jp	http://www.nenkin.go.jp/denshibenri/setsumei/0104.html	Patch, Vendor Advisory
vultures@jpcert.or.jp	http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html	Patch, Vendor Advisory
vultures@jpcert.or.jp	http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html	Patch, Vendor Advisory
vultures@jpcert.or.jp	http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck	Patch, Vendor Advisory
vultures@jpcert.or.jp	http://www.securityfocus.com/bid/94616	Third Party Advisory, VDB Entry
vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN08868688/index.html	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://www.nenkin.go.jp/denshibenri/setsumei/0104.html	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/94616	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://jvn.jp/en/jp/JVN08868688/index.html	Third Party Advisory, VDB Entry

Impacted products

Vendor	Product	Version
japan_pension_service	device_data_encryption_program	1.00
japan_pension_service	specification_check_program	9.00
japan_pension_service	todokesho_creation_program	15.00
japan_pension_service	todokesho_print_program	5.00

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:japan_pension_service:device_data_encryption_program:1.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2EE2251-2F1A-44FE-94E0-94C75200ED2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:japan_pension_service:specification_check_program:9.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "4038181E-5454-417C-AAE7-C8FD3A8EAEB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:japan_pension_service:todokesho_creation_program:15.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "14C4E1CC-9E90-4E0D-823B-0B2E9EA2FE23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:japan_pension_service:todokesho_print_program:5.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D55DFBC-CFE6-43C6-8A61-848FE0BCE8CB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de ruta (path) de b\u00fasqueda no segura en Instalador para programa de comprobaci\u00f3n Specification (social insurance) versi\u00f3n 9.00 y anteriores, programa de impresi\u00f3n de TODOKESHO versi\u00f3n 5.00 y anteriores, programa de cifrado de datos de Device versi\u00f3n 1.00 y anteriores, y programa de creaci\u00f3n de TODOKESHO versi\u00f3n 15.00 y anteriores disponibles antes del 17 de octubre de 2016, permite a los atacantes remotos alcanzar privilegios por medio de un archivo DLL de tipo caballo de Troya en un directorio no especificado."
    }
  ],
  "id": "CVE-2016-7818",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-06-09T16:29:00.797",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/0104.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/94616"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://jvn.jp/en/jp/JVN08868688/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/0104.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/94616"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://jvn.jp/en/jp/JVN08868688/index.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

JVNDB-2016-000233

Vulnerability from jvndb - Published: 2016-12-01 13:40 - Updated:2018-01-17 13:54

Severity ?

7.8 (High) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

The installers of multiple Japan Pension Service software may insecurely load Dynamic Link Libraries

Details

The installers of multiple Japan Pension Service software contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	http://jvn.jp/en/jp/JVN08868688/index.html
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7818
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-7818
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	Japan Pension Service	Device data encryption program
	Japan Pension Service	Specification check program(social insurance)
	Japan Pension Service	TODOKESHO creation program
	Japan Pension Service	TODOKESHO print program

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000233.html",
  "dc:date": "2018-01-17T13:54+09:00",
  "dcterms:issued": "2016-12-01T13:40+09:00",
  "dcterms:modified": "2018-01-17T13:54+09:00",
  "description": "The installers of multiple Japan Pension Service software contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.\r\n\r\nYuji Tounai of NTT Communications Corporation reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000233.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:japan_pension_service:device_data_encryption_program",
      "@product": "Device data encryption program",
      "@vendor": "Japan Pension Service",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:japan_pension_service:specification_check_program",
      "@product": "Specification check program(social insurance)",
      "@vendor": "Japan Pension Service",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:japan_pension_service:todokesho_creation_program",
      "@product": "TODOKESHO creation program",
      "@vendor": "Japan Pension Service",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:japan_pension_service:todokesho_print_program",
      "@product": "TODOKESHO print program",
      "@vendor": "Japan Pension Service",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "7.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000233",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN08868688/index.html",
      "@id": "JVN#08868688",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7818",
      "@id": "CVE-2016-7818",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2016-7818",
      "@id": "CVE-2016-7818",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "The installers of multiple Japan Pension Service software may insecurely load Dynamic Link Libraries"
}

CNVD-2016-11955

Vulnerability from cnvd - Published: 2016-12-06

Title

多款Japan Pension Service产品任意代码执行漏洞

Description

Japan Pension Service Specification check program等都是日本Japan Pension Service机构的养老服务软件。多款Japan Pension Service产品中存在任意代码执行漏洞，该漏洞源于程序未能验证用户提交的输入。攻击者可利用该漏洞执行任意代码。

Severity

高

Patch Name

多款Japan Pension Service产品任意代码执行漏洞的补丁

Patch Description

Japan Pension Service Specification check program等都是日本Japan Pension Service机构的养老服务软件。多款Japan Pension Service产品中存在任意代码执行漏洞，该漏洞源于程序未能验证用户提交的输入。攻击者可利用该漏洞执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，详情请关注厂商主页： http://www.nenkin.go.jp/

Reference

http://www.securityfocus.com/bid/94616

Impacted products

Name
['Japan Pension Service Specification check program(social insurance) <=9.00', 'Japan Pension Service TODOKESHO print program <=5.00', 'Japan Pension Service Device data encryption program <=1.00', 'Japan Pension Service TODOKESHO creation program <=15.00']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94616"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-7818"
    }
  },
  "description": "Japan Pension Service Specification check program\u7b49\u90fd\u662f\u65e5\u672cJapan Pension Service\u673a\u6784\u7684\u517b\u8001\u670d\u52a1\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u6b3eJapan Pension Service\u4ea7\u54c1\u4e2d\u5b58\u5728\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u9a8c\u8bc1\u7528\u6237\u63d0\u4ea4\u7684\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "Yuji Tounai of NTT Communications Corporation.",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttp://www.nenkin.go.jp/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-11955",
  "openTime": "2016-12-06",
  "patchDescription": "Japan Pension Service Specification check program\u7b49\u90fd\u662f\u65e5\u672cJapan Pension Service\u673a\u6784\u7684\u517b\u8001\u670d\u52a1\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u6b3eJapan Pension Service\u4ea7\u54c1\u4e2d\u5b58\u5728\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u9a8c\u8bc1\u7528\u6237\u63d0\u4ea4\u7684\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eJapan Pension Service\u4ea7\u54c1\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Japan Pension Service Specification check program(social insurance) \u003c=9.00",
      "Japan Pension Service TODOKESHO print program \u003c=5.00",
      "Japan Pension Service Device data encryption program \u003c=1.00",
      "Japan Pension Service TODOKESHO creation program \u003c=15.00"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/94616",
  "serverity": "\u9ad8",
  "submitTime": "2016-12-05",
  "title": "\u591a\u6b3eJapan Pension Service\u4ea7\u54c1\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

GSD-2016-7818

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2016-7818

Aliases

CVE-2016-7818

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2016-7818",
    "description": "Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.",
    "id": "GSD-2016-7818"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2016-7818"
      ],
      "details": "Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.",
      "id": "GSD-2016-7818",
      "modified": "2023-12-13T01:21:21.063936Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2016-7818",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Intstaller for Specification check program(social insurance)",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Ver. 9.00 and earlier that was available prior to October 17, 2016"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Intstaller for TODOKESHO print program",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Ver. 5.00 and earlier that was available prior to October 17, 2016"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Intstaller for Device data encryption program",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Ver. 1.00 and earlier that was available prior to October 17, 2016"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Intstaller for TODOKESHO creation program",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Ver. 15.00 and earlier that was available prior to October 17, 2016"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Japan Pension Service"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Untrusted search path vulnerability"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html",
            "refsource": "CONFIRM",
            "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html"
          },
          {
            "name": "http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html",
            "refsource": "CONFIRM",
            "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html"
          },
          {
            "name": "http://www.nenkin.go.jp/denshibenri/setsumei/0104.html",
            "refsource": "CONFIRM",
            "url": "http://www.nenkin.go.jp/denshibenri/setsumei/0104.html"
          },
          {
            "name": "94616",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/94616"
          },
          {
            "name": "http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck",
            "refsource": "CONFIRM",
            "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck"
          },
          {
            "name": "JVN#08868688",
            "refsource": "JVN",
            "url": "https://jvn.jp/en/jp/JVN08868688/index.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:japan_pension_service:specification_check_program:9.00:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:japan_pension_service:todokesho_print_program:5.00:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:japan_pension_service:todokesho_creation_program:15.00:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:japan_pension_service:device_data_encryption_program:1.00:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2016-7818"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-264"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVN#08868688",
              "refsource": "JVN",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://jvn.jp/en/jp/JVN08868688/index.html"
            },
            {
              "name": "http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150415.html#cmscheck"
            },
            {
              "name": "http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20150105-03.html"
            },
            {
              "name": "http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.nenkin.go.jp/denshibenri/setsumei/20140630.html"
            },
            {
              "name": "http://www.nenkin.go.jp/denshibenri/setsumei/0104.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.nenkin.go.jp/denshibenri/setsumei/0104.html"
            },
            {
              "name": "94616",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/94616"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2017-06-22T18:33Z",
      "publishedDate": "2017-06-09T16:29Z"
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2016-7818 (GCVE-0-2016-7818)

GHSA-6J3F-X2F3-WHQ9

FKIE_CVE-2016-7818

JVNDB-2016-000233

CNVD-2016-11955

GSD-2016-7818

Tags

Sightings

Nomenclature