Sign-up

ID

VAR-201809-1397


TITLE

(0Day) Fuji Electric Frenic Loader FNC File Parsing Buffer Overflow Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-18-1086

DESCRIPTION

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Fuji Electric Frenic Loader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within processing of FNC files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of an administrator.

Trust: 0.7

sources: ZDI: ZDI-18-1086

AFFECTED PRODUCTS

vendor:fuji electricmodel:frenic loaderscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-18-1086

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: ZDI-18-1086
value: HIGH

Trust: 0.7

ZDI: ZDI-18-1086
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

sources: ZDI: ZDI-18-1086

EXTERNAL IDS

db:ZDI_CANid:ZDI-CAN-6239

Trust: 0.7

db:ZDIid:ZDI-18-1086

Trust: 0.7

sources: ZDI: ZDI-18-1086

CREDITS

Michael Flanders of the Zero Day Initiative

Trust: 0.7

sources: ZDI: ZDI-18-1086

SOURCES

db:ZDIid:ZDI-18-1086

LAST UPDATE DATE

2022-05-17T02:09:44.248000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-18-1086date:2018-09-26T00:00:00

SOURCES RELEASE DATE

db:ZDIid:ZDI-18-1086date:2018-09-26T00:00:00