HOME >> IT Security >> Vulnerabilities >> Security Alert for Vulnerability in the Ichitaro Series
Security Alert for Vulnerability in the Ichitaro Series
Published: Jun 16, 2011
>> JAPANESE
Information-technology Promotion Agency, Japan (IPA, Chairman Kazumasa Fujie) has issued a security alert concerning security vulnerability in the Ichitaro Series on June 16, 2011. To fix this vulnerability, update the software to the fixed version provided by the Product vendor.
1.Overview
The Ichitaro series developed by JustSystems Corporation is a Japanese word-processing software. It is widely used in Japan as one of the software applications to create word documents.
The Ichitaro series is vulnerable to arbitrary code execution due to a flaw in a way it loads a document file. If exploited, an attacker could execute arbitrary code on the computer installed with the Ichitaro series.
To get the fixed version, go to the following URL:
http://www.justsystems.com/jp/info/js11001.html (Japanese)
For the latest information, refer to the following URL:
http://jvndb.jvn.jp/jvndb/JVNDB-2011-000043
IPA and JPCERT Coordination Center (JPCERT/CC) received a report concerning this vulnerability directly from the product vendor on June 13, 2011, and released it today.
2.Impact
An attacker could install malicious programs, alter or delete data, when the user on an affected system opens a maliciously crafted document file attached to email or in web browsers.Especially when viewing such a document in web browsers, depending on the settings and the kind of web browser, there is the possibility that harm may be done by just accessing a malicious URL.
3.Solution
To fix this vulnerability, update the software to the fixed version provided by the product vendor.
4.CVSS Severity
(1)Evaluation Result
| Severity Rating (CVSS base score) |
□ Low (0.0~3.9) |
□Medium (4.0~6.9) |
■ High (7.0~10.0) |
|---|---|---|---|
| CVSS base score | 9.3 |
(2) Base Score Metrics
| AV:Access Vector | □ Local | □ Adjacent Network |
■ Network |
|---|---|---|---|
| AC:Access Complexity | □ High | ■ Medium | □ Low |
| Au:Authentication | □ Multiple | □ Single | ■ None |
| C:Confidentiality Impact | □ None | □ Partial | ■ Complete |
| I:Integrity Impact | □ None | □ Partial | ■ Complete |
| A:Availability Impact | □ None | □ Partial | ■ Complete |
■:Selected Values
5.CWE Type
This vulnerability has been CWE classified as “No Mapping” (CWE-noinfo)”
Contact
IT Security Center,
Information-technology Promotion Agency, Japan (ISEC/IPA)
E-mail: 