jvndb-2016-000249
Vulnerability from jvndb
Published
2016-12-22 14:26
Modified
2017-11-27 16:53
Severity ?
Summary
SKYSEA Client View vulnerable to arbitrary code execution
Details
SKYSEA Client View provided by Sky Co., LTD. is an Enterprise IT Asset Management Tool. SKYSEA Client View agent program contains an issue in processing authentication on the TCP communication with the management console program, which allows an attacker to execute an arbitrary code on the client PC.
Attacks exploiting this vulnerability have been observed in the wild.
Sky Co., LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Sky Co., LTD. coordinated under the Information Security Early Warning Partnership.
References
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| Sky Co., LTD. | SKYSEA Client View |
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000249.html",
"dc:date": "2017-11-27T16:53+09:00",
"dcterms:issued": "2016-12-22T14:26+09:00",
"dcterms:modified": "2017-11-27T16:53+09:00",
"description": "SKYSEA Client View provided by Sky Co., LTD. is an Enterprise IT Asset Management Tool. SKYSEA Client View agent program contains an issue in processing authentication on the TCP communication with the management console program, which allows an attacker to execute an arbitrary code on the client PC.\r\n\r\nAttacks exploiting this vulnerability have been observed in the wild.\r\n\r\nSky Co., LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Sky Co., LTD. coordinated under the Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000249.html",
"sec:cpe": {
"#text": "cpe:/a:skygroup:skysea_client_view",
"@product": "SKYSEA Client View",
"@vendor": "Sky Co., LTD.",
"@version": "2.2"
},
"sec:cvss": [
{
"@score": "10.0",
"@severity": "High",
"@type": "Base",
"@vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"@version": "2.0"
},
{
"@score": "9.8",
"@severity": "Critical",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2016-000249",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN84995847/index.html",
"@id": "JVN#84995847",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7836",
"@id": "CVE-2016-7836",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2016-7836",
"@id": "CVE-2016-7836",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/security/ciadr/vul/20161222-jvn.html",
"@id": "Security Alert for Vulnerability in SKYSEA Client View (JVN#84995847",
"@source": "IPA SECURITY ALERTS"
},
{
"#text": "https://www.jpcert.or.jp/at/2016/at160051.html",
"@id": "JPCERT-AT-2016-0051",
"@source": "JPCERT"
},
{
"#text": "https://www.npa.go.jp/cyberpolice/detect/pdf/20161222.pdf",
"@id": "Security Alert for Vulnerability in SKYSEA Client View",
"@source": "AT-POLICE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-noinfo",
"@title": "No Mapping(CWE-noinfo)"
}
],
"title": "SKYSEA Client View vulnerable to arbitrary code execution"
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.