JVN#20409270: Installer of Douroshisetu Kihon Data Sakusei System may insecurely load Dynamic Link Libraries

The installer of Douroshisetu Kihon Data Sakusei System provided by National Institute for Land and Infrastructure Management contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427).

Impact

Arbitrary code may be executed with the privilege of the use invoking the installer.

Solution

Apply Workaround
Be sure to check no malicious file exists in the same directory where the installer is placed.

According to the developer, the distributed archive file contains a directory and the installer (setup.exe) in it.
When extracting the archive file, a clean directory which contains the installer is created.
Be sure not to copy any files into this directory before executing the installer. Keep this directory clean.

Products Affected

• Douroshisetu Kihon Data Sakusei System Ver1.0.2 and earlier