PT-2017-15218 · Just+2 · Just Frontier+9

Published 2017-04-28 · Updated 2017-05-12 · CVE-2017-2154

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hanako versions 2015 through 2017 Hanako Pro version 3 JUST Office versions 3 [Standard] through 3 [Eco Print Package] JUST Office 3 & Tri-De DataProtect Package JUST Government version 3 JUST Jump Class version 2 JUST Frontier version 3 JUST School version 6 Premium Hanako Police version 5 JUST Police version 3 Hanako 2017 trial version

Description The issue allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory due to an untrusted search path vulnerability.

Recommendations For Hanako versions 2015 through 2017, Hanako Pro version 3, JUST Office versions 3 [Standard] through 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government version 3, JUST Jump Class version 2, JUST Frontier version 3, JUST School version 6 Premium, Hanako Police version 5, JUST Police version 3, and Hanako 2017 trial version: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-2154

Affected Products

Hanako

Hanako Police

Hanako Pro

Just Frontier

Just Government

Just Jump Class

Just Office

Just Police

Just School

Tri-De Dataprotect Package

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-2154 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2154 · Vendor Advisory
• https://justsystems.com/jp/info/js17002.html · Vendor Advisory
• https://jvn.jp/en/jp/JVN54268888/index.html · Note