HOMEIT SecurityMeasures for Information Security VulnerabilitiesIPA/ISEC：Vulnerabilities：Security Alert for Vulnerability in ATOK
September 2, 2009
>> JAPANESE
The Information-technology Promotion Agency (IPA, Chairman Koji Nishigaki) announced a security alert on September 2, 2009 concerning security vulnerability in “ATOK”.
This vulnerability allows an attacker to bypass the screen lock protection of personal computers installed with “ATOK”.
If exploited, there is a possibility that arbitrary commands or programs may be executed on that personal computer.
To fix this vulnerability, update to the fixed version supplied by the vendor.
“ATOK” is a Japanese input method provided by JustSystems Corporation.
Vulnerability exists in “ATOK”, which allows the screen lock protection on the personal computer to be bypassed.
If this weakness is exploited, there is a possibility that arbitrary commands or programs may be executed.
For detailed information, refer to the following URL:
http://www.justsystems.com/jp/info/js09003.html (Japanese)
For the latest information, refer to the following URL:
http://jvndb.jvn.jp/jvndb/JVNDB-2009-000057
The IPA first received a report concerning this vulnerability through the creditee below on April 23, 2009, and the JPCERT Coordination Center (JPCERT/CC), in line with the Information Security Early Warning Partnership, made adjustments to clarify the matter with the vendor and made the announcement public on September 2, 2009.
Credit: Taku Kudo, Google Inc.
In the event an attacker conducts a specific sequence of operations on a screen-locked personal computer, it allows the attacker to bypass the screen lock protection.
As a result, there is a possibility that arbitrary commands or programs may be executed using the authorization of a local system account of that personal computer.
To fix this vulnerability, update to the fixed version supplied by the vendor.
| Severity Rating (CVSS base score) |
□ Low (0.0~3.9) |
□ Medium (4.0~6.9) |
■ High (7.0~10.0) |
|---|---|---|---|
| CVSS base score | 7.2 |
| AV:Access Vector | ■ Local | □ Adjacent Network |
□ Network |
|---|---|---|---|
| AC:Access Complexity | □ High | □ Medium | ■ Low |
| Au:Authentication | □ Multiple | □ Single | ■ None |
| C:Confidentiality Impact | □ None | □ Partial | ■ Complete |
| I:Integrity Impact | □ None | □ Partial | ■ Complete |
| A:Availability Impact | □ None | □ Partial | ■ Complete |
■:Selected Values
IT Security Center,
Information-technology Promotion Agency, Japan (ISEC/IPA)
E-mail: 
