Vulnerability-Lookup

VAR-201005-0436

Vulnerability from variot - Updated: 2022-05-17 02:10

An arbitrary code execution vulnerability exists in the system installed with XMAP3/Web, or it may experience unexpected shutdown of Internet Explorer. The same issues exist in the Web browser testing tool, a web system development feature that comes with XMAP3/NET and XMAP3/Enterprise Edition.A remote attacker could execute arbitrary code on the affected system. Failed exploit attempts will result in a denial-of-service condition. ----------------------------------------------------------------------

Looking for a job?

Secunia is hiring skilled researchers and talented developers. Internet Explorer.

The vulnerability is reported in the following products: * XMAP3/Web version 4 * XMAP3/Web for Cosminexus * XMAP3/NET version 4 * XMAP3/Enterprise Edition version 4

SOLUTION: Apply patches. Please see the vendor's advisory for a patch matrix.

PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.

ORIGINAL ADVISORY: Hitachi: http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-004/index.html

OTHER REFERENCES: JVN: http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-001427.html

About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website

JSON

To clipboard Create KEV Entry

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201005-0436",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "xmap3/enterprise edition",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "version 4"
      },
      {
        "model": "xmap3/net",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "version 4"
      },
      {
        "model": "xmap3/web",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "for cosminexus"
      },
      {
        "model": "xmap3/web",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "version 4"
      },
      {
        "model": "xmap3/enterprise edition",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "4.x"
      },
      {
        "model": "xmap3/net",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "4.x"
      },
      {
        "model": "xmap3/web",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "hitachi",
        "version": "4.x"
      },
      {
        "model": "xmap3/web for cosminexus xmap3/web for cosminexus",
        "scope": null,
        "trust": 0.6,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "xmap3/web for cosminexus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "model": "xmap3/web",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "model": "xmap3/net",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      },
      {
        "model": "xmap3/enterprise edition",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hitachi",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2010-0898"
      },
      {
        "db": "BID",
        "id": "40218"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001427"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:hitachi:xmap3_enterprise_edition",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:xmap3_net",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:xmap3_web",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001427"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "40218"
      }
    ],
    "trust": 0.3
  },
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "IPA",
            "availabilityImpact": "Complete",
            "baseScore": 9.3,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "JVNDB-2010-001427",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "IPA",
            "id": "JVNDB-2010-001427",
            "trust": 0.8,
            "value": "High"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001427"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An arbitrary code execution vulnerability exists in the system installed with XMAP3/Web, or it may experience unexpected shutdown of Internet Explorer. The same issues exist in the Web browser testing tool, a web system development feature that comes with XMAP3/NET and XMAP3/Enterprise Edition.A remote attacker could execute arbitrary code on the affected system. Failed exploit attempts will result in a denial-of-service condition. ----------------------------------------------------------------------\n\n\nLooking for a job?\n\n\nSecunia is hiring skilled researchers and talented developers. Internet Explorer. \n\nThe vulnerability is reported in the following products:\n* XMAP3/Web version 4\n* XMAP3/Web for Cosminexus\n* XMAP3/NET version 4\n* XMAP3/Enterprise Edition version 4\n\nSOLUTION:\nApply patches. Please see the vendor\u0027s advisory for a patch matrix. \n\nPROVIDED AND/OR DISCOVERED BY:\nReported by the vendor. \n\nORIGINAL ADVISORY:\nHitachi:\nhttp://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-004/index.html\n\nOTHER REFERENCES:\nJVN:\nhttp://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-001427.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001427"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2010-0898"
      },
      {
        "db": "BID",
        "id": "40218"
      },
      {
        "db": "PACKETSTORM",
        "id": "89616"
      }
    ],
    "trust": 1.62
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "HITACHI",
        "id": "HS10-004",
        "trust": 1.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001427",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2010-0898",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "40218",
        "trust": 0.3
      },
      {
        "db": "SECUNIA",
        "id": "39853",
        "trust": 0.3
      },
      {
        "db": "PACKETSTORM",
        "id": "89616",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2010-0898"
      },
      {
        "db": "BID",
        "id": "40218"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001427"
      },
      {
        "db": "PACKETSTORM",
        "id": "89616"
      }
    ]
  },
  "id": "VAR-201005-0436",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2010-0898"
      }
    ],
    "trust": 1.35
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS",
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2010-0898"
      }
    ]
  },
  "last_update_date": "2022-05-17T02:10:51.468000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "HS10-004",
        "trust": 0.8,
        "url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs10-004/index.html"
      },
      {
        "title": "Hitachi XMAP3 product code execution patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/407"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2010-0898"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001427"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 0.6,
        "url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs10-004/index.htmlhttp"
      },
      {
        "trust": 0.4,
        "url": "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs10-004/index.html"
      },
      {
        "trust": 0.3,
        "url": "http://www.hitachi.com/index.html"
      },
      {
        "trust": 0.1,
        "url": "http://jvndb.jvn.jp/en/contents/2010/jvndb-2010-001427.html"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/company/jobs/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/39853/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/about_secunia_advisories/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2010-0898"
      },
      {
        "db": "BID",
        "id": "40218"
      },
      {
        "db": "PACKETSTORM",
        "id": "89616"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2010-0898"
      },
      {
        "db": "BID",
        "id": "40218"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001427"
      },
      {
        "db": "PACKETSTORM",
        "id": "89616"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2010-05-19T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2010-0898"
      },
      {
        "date": "2010-04-21T00:00:00",
        "db": "BID",
        "id": "40218"
      },
      {
        "date": "2010-05-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2010-001427"
      },
      {
        "date": "2010-05-18T15:00:31",
        "db": "PACKETSTORM",
        "id": "89616"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2010-05-19T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2010-0898"
      },
      {
        "date": "2010-04-21T00:00:00",
        "db": "BID",
        "id": "40218"
      },
      {
        "date": "2010-05-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2010-001427"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "40218"
      }
    ],
    "trust": 0.3
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XMAP3 Arbitrary Code Execution Vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001427"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Unknown",
    "sources": [
      {
        "db": "BID",
        "id": "40218"
      }
    ],
    "trust": 0.3
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201005-0436

Tags

Sightings

Nomenclature