Details of VAR-201204-0332

ID

VAR-201204-0332

TITLE

Fujitsu Interstage List Works Archive Folder Security Bypass Vulnerability

Trust: 1.7

sources: IVD: 08b28f2e-1f6c-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-1860 // BID: 52978 // CNNVD: CNNVD-201210-484

DESCRIPTION

Fujitsu Interstage List Works has a vulnerability where, when Everyone or a group is granted permissions to access the archive folder and data through the management tool or command line, denying permissions for a specific user who belongs to these groups fails and is not reflected on the lists.A user who is denied permission to access a specific data may access and delete the list. Interstage List Works is an electronic form management software. Interstage List Works has a security vulnerability that allows malicious users to bypass security restrictions. Attackers can exploit this issue to bypass security restrictions to perform unauthorized actions like disclosing or deleting data in archive folder; this may aid in launching further attacks. ---------------------------------------------------------------------- Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch ---------------------------------------------------------------------- TITLE: Fujitsu Interstage List Works Archived Forms Security Bypass Weakness SECUNIA ADVISORY ID: SA48745 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48745/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48745 RELEASE DATE: 2012-04-11 DISCUSS ADVISORY: http://secunia.com/advisories/48745/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/48745/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=48745 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A weakness has been reported in Interstage List Works, which can be exploited by malicious users to bypass certain security restrictions. This can be exploited to disclose or delete archived forms. Please see the vendor's advisory for a list of affected products and versions. SOLUTION: Apply the vendor workaround (please see the vendor's advisory for details). PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: Fujitsu: http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_lw_201201.html JVN: http://jvndb.jvn.jp/en/contents/2012/JVNDB-2012-001932.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.8

sources: JVNDB: JVNDB-2012-001932 // CNVD: CNVD-2012-1860 // BID: 52978 // IVD: 08b28f2e-1f6c-11e6-abef-000c29c66e3d // PACKETSTORM: 111766

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 08b28f2e-1f6c-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-1860

AFFECTED PRODUCTS

vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	7.x	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	enterprise edition 8.0.0 and 8.0.1	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	enterprise edition v10.0.0 and v10.1.0	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	enterprise edition v7.0l10	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	enterprise edition v7.0l10a through v7.0l10d	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	enterprise edition v9.0.1 and v9.0.1a	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	enterprise edition v9.1.0	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	standard edition 8.0.0 and 8.0.1	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	standard edition v10.0.0 and v10.1.0	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	standard edition v7.0l10	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	standard edition v7.0l10a through v7.0l10d	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	standard edition v9.0.1 and v9.0.1a	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	standard edition v9.1.0	Trust: 0.8
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	10.x	Trust: 0.6
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	9.x	Trust: 0.6
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	8.x	Trust: 0.6
vendor:	fujitsu	model:	interstage list works standard edition	scope:	eq	version:	9.1.0	Trust: 0.3
vendor:	fujitsu	model:	interstage list works standard edition 9.0.1a	scope:	-	version:	-	Trust: 0.3
vendor:	fujitsu	model:	interstage list works standard edition	scope:	eq	version:	9.0.1	Trust: 0.3
vendor:	fujitsu	model:	interstage list works standard edition	scope:	eq	version:	8.0.1	Trust: 0.3
vendor:	fujitsu	model:	interstage list works standard edition	scope:	eq	version:	8.0.0	Trust: 0.3
vendor:	fujitsu	model:	interstage list works standard edition 7.0l10d	scope:	-	version:	-	Trust: 0.3
vendor:	fujitsu	model:	interstage list works standard edition 7.0l10a	scope:	-	version:	-	Trust: 0.3
vendor:	fujitsu	model:	interstage list works standard edition 7.0l10	scope:	-	version:	-	Trust: 0.3
vendor:	fujitsu	model:	interstage list works standard edition	scope:	eq	version:	10.1.0	Trust: 0.3
vendor:	fujitsu	model:	interstage list works standard edition	scope:	eq	version:	10.0.0	Trust: 0.3
vendor:	fujitsu	model:	interstage list works enterprise edition	scope:	eq	version:	9.1.0	Trust: 0.3
vendor:	fujitsu	model:	interstage list works enterprise edition 9.0.1a	scope:	-	version:	-	Trust: 0.3
vendor:	fujitsu	model:	interstage list works enterprise edition	scope:	eq	version:	9.0.1	Trust: 0.3
vendor:	fujitsu	model:	interstage list works enterprise edition	scope:	eq	version:	8.0.1	Trust: 0.3
vendor:	fujitsu	model:	interstage list works enterprise edition 7.0l10d	scope:	-	version:	-	Trust: 0.3
vendor:	fujitsu	model:	interstage list works enterprise edition 7.0l10a	scope:	-	version:	-	Trust: 0.3
vendor:	fujitsu	model:	interstage list works enterprise edition 7.0l10	scope:	-	version:	-	Trust: 0.3
vendor:	fujitsu	model:	interstage list works enterprise edition	scope:	eq	version:	10.1.0	Trust: 0.3
vendor:	fujitsu	model:	interstage list works enterprise edition	scope:	eq	version:	10.0.0	Trust: 0.3
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	10.x*	Trust: 0.2
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	9.x*	Trust: 0.2
vendor:	fujitsu	model:	interstage list works	scope:	eq	version:	8.x*	Trust: 0.2

sources: IVD: 08b28f2e-1f6c-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-1860 // BID: 52978 // JVNDB: JVNDB-2012-001932

CVSS

SEVERITY

CVSSV2

CVSSV3

IPA:	JVNDB-2012-001932
value:	LOW
Trust: 0.8
IVD:	08b28f2e-1f6c-11e6-abef-000c29c66e3d
value:	LOW
Trust: 0.2

IPA:	JVNDB-2012-001932
severity:	LOW
baseScore:	3.6
vectorString:	AV:N/AC:H/AU:S/C:P/I:C/A:P
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	COMPLETE
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
IVD:	08b28f2e-1f6c-11e6-abef-000c29c66e3d
severity:	NONE
baseScore:	NONE
vectorString:	NONE
accessVector:	NONE
accessComplexity:	NONE
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	UNKNOWN
Trust: 0.2

sources: IVD: 08b28f2e-1f6c-11e6-abef-000c29c66e3d // JVNDB: JVNDB-2012-001932

PROBLEMTYPE DATA

problemtype:

CWE-264

Trust: 0.8

sources: JVNDB: JVNDB-2012-001932

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201210-484

TYPE

Access Validation Error

Trust: 0.3

sources: BID: 52978

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-001932

PATCH

title:	interstage_lw_201201	url:	http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_lw_201201.html	Trust: 0.8
title:	Fujitsu Interstage List Works Archive Folder Security Bypass Vulnerability Patch	url:	https://www.cnvd.org.cn/patchinfo/show/15731	Trust: 0.6

sources: CNVD: CNVD-2012-1860 // JVNDB: JVNDB-2012-001932

EXTERNAL IDS

db:	BID	id:	52978	Trust: 1.5
db:	JVNDB	id:	JVNDB-2012-001932	Trust: 1.2
db:	CNVD	id:	CNVD-2012-1860	Trust: 0.8
db:	CNNVD	id:	CNNVD-201210-484	Trust: 0.6
db:	IVD	id:	08B28F2E-1F6C-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	SECUNIA	id:	48745	Trust: 0.2
db:	PACKETSTORM	id:	111766	Trust: 0.1

sources: IVD: 08b28f2e-1f6c-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-1860 // BID: 52978 // JVNDB: JVNDB-2012-001932 // PACKETSTORM: 111766 // CNNVD: CNNVD-201210-484

REFERENCES

url:	http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_lw_201201.htmlhttp	Trust: 0.6
url:	http://www.securityfocus.com/bid/52978	Trust: 0.6
url:	http://software.fujitsu.com/jp/security/products-fujitsu/solution/interstage_lw_201201.html	Trust: 0.4
url:	http://jvndb.jvn.jp/en/contents/2012/jvndb-2012-001932.html	Trust: 0.4
url:	http://www.fujitsu.com/	Trust: 0.3
url:	http://interstage.fujitsu.com/jp/listworks/	Trust: 0.3
url:	https://ca.secunia.com/?page=viewadvisory&vuln_id=48745	Trust: 0.1
url:	http://secunia.com/advisories/48745/#comments	Trust: 0.1
url:	http://secunia.com/psi_30_beta_launch	Trust: 0.1
url:	http://secunia.com/advisories/48745/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/	Trust: 0.1
url:	http://secunia.com/vulnerability_intelligence/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/vulnerability_scanning/personal/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: CNVD: CNVD-2012-1860 // BID: 52978 // PACKETSTORM: 111766 // CNNVD: CNNVD-201210-484

CREDITS

Reported by the vendor

Trust: 0.3

sources: BID: 52978

SOURCES

db:	IVD	id:	08b28f2e-1f6c-11e6-abef-000c29c66e3d
db:	CNVD	id:	CNVD-2012-1860
db:	BID	id:	52978
db:	JVNDB	id:	JVNDB-2012-001932
db:	PACKETSTORM	id:	111766
db:	CNNVD	id:	CNNVD-201210-484

LAST UPDATE DATE

2022-05-17T01:51:41.327000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2012-1860	date:	2012-04-13T00:00:00
db:	BID	id:	52978	date:	2015-03-19T09:16:00
db:	JVNDB	id:	JVNDB-2012-001932	date:	2012-04-11T00:00:00
db:	CNNVD	id:	CNNVD-201210-484	date:	2012-10-22T00:00:00

SOURCES RELEASE DATE

db:	IVD	id:	08b28f2e-1f6c-11e6-abef-000c29c66e3d	date:	2012-04-13T00:00:00
db:	CNVD	id:	CNVD-2012-1860	date:	2012-04-13T00:00:00
db:	BID	id:	52978	date:	2012-04-11T00:00:00
db:	JVNDB	id:	JVNDB-2012-001932	date:	2012-04-11T00:00:00
db:	PACKETSTORM	id:	111766	date:	2012-04-11T07:09:45
db:	CNNVD	id:	CNNVD-201210-484	date:	2012-04-11T00:00:00