製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の Flexense 製品の Import Command におけるバッファオーバーフローの脆弱性

Title	複数の Flexense 製品の Import Command におけるバッファオーバーフローの脆弱性
Summary	Flexense Sync Breeze Enterprise Client、Disk Sorter Enterprise Client、および DiskBoss Enterprise Client の Import Command には、バッファオーバーフローの脆弱性が存在します。
Possible impacts	攻撃者により、classify 要素の過度に長い名前属性を含む巧妙に細工された XML ファイルを介して、任意のコードを実行される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	March 29, 2017, midnight
Registration Date	April 28, 2017, 11:51 a.m.
Last Update	April 28, 2017, 11:51 a.m.

Affected System

Flexense Ltd.

DiskBoss 7.8.16

DiskSorter 9.5.12

SyncBreeze 9.5.16

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-7310	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7310
National Vulnerability Database (NVD)
2	CVE-2017-7310	https://nvd.nist.gov/vuln/detail/CVE-2017-7310

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

その他

No	Name	URL
関連文書
1	Multiple Flexense Products CVE-2017-7310 Buffer Overflow Vulnerability	http://www.securityfocus.com/bid/97237

Change Log

No	Changed Details	Date of change
0	[2017年04月28日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-7310

Summary	A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskSavvy before 10.6, DupScout before 10.6, and VX Search before 10.6 allows attackers to execute arbitrary code via a crafted XML file containing a long name attribute of a classify element.
Publication Date	March 30, 2017, 6:59 a.m.
Registration Date	Jan. 26, 2021, 1:28 p.m.
Last Update	Nov. 21, 2024, 12:31 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:flexense:syncbreeze:9.5.16::::enterprise:::
cpe:2.3:a:flexense:diskboss:7.8.16::::enterprise:::
cpe:2.3:a:flexense:disksorter:9.5.12::::enterprise:::

Related information, measures and tools

No	URL	タグ
1	http://www.diskboss.com/news.html
2	http://www.diskboss.com/news.html
3	http://www.diskpulse.com/news.html
4	http://www.diskpulse.com/news.html
5	http://www.disksavvy.com/news.html
6	http://www.disksavvy.com/news.html
7	http://www.disksorter.com/news.html
8	http://www.disksorter.com/news.html
9	http://www.dupscout.com/news.html
10	http://www.dupscout.com/news.html
11	http://www.securityfocus.com/bid/97237	Third Party Advisory VDB Entry
12	http://www.securityfocus.com/bid/97237	Third Party Advisory VDB Entry
13	http://www.syncbreeze.com/news.html
14	http://www.syncbreeze.com/news.html
15	http://www.vxsearch.com/news.html
16	http://www.vxsearch.com/news.html
17	https://www.exploit-db.com/exploits/41771/	Exploit Third Party Advisory VDB Entry
18	https://www.exploit-db.com/exploits/41771/	Exploit Third Party Advisory VDB Entry
19	https://www.exploit-db.com/exploits/41772/	Exploit Third Party Advisory VDB Entry
20	https://www.exploit-db.com/exploits/41772/	Exploit Third Party Advisory VDB Entry
21	https://www.exploit-db.com/exploits/41773/	Exploit Third Party Advisory VDB Entry
22	https://www.exploit-db.com/exploits/41773/	Exploit Third Party Advisory VDB Entry
23	https://www.exploit-db.com/exploits/43875/
24	https://www.exploit-db.com/exploits/43875/
25	https://www.exploit-db.com/exploits/44157/
26	https://www.exploit-db.com/exploits/44157/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html