JVN#57205588: Installer of FENCE-Explorer may insecurely load Dynamic Link Libraries and invoke executable files

2017-09-11T00:00:00
ID JVN:57205588
Type jvn
Reporter Japan Vulnerability Notes
Modified 2017-09-11T00:00:00

Description

## Description

FENCE-Explorer provided by FUJITSU BROAD SOLUTION & CONSULTING Inc. is a tool to view and edit a file in "FENCE Briefcase" which is created by FENCE-Pro and other FENCE series software. Installer of FENCE-Explorer contains an issue with the search path for DLL/executable files, which may lead to insecurely loading Dynamic Link Libraries and invoking executable files (CWE-427).

## Impact

Arbitrary code may be executed with the privilege of the user invoking the installer.

## Solution

Use the latest installer
Use the latest installer according to the information provided by the developer.
Users who already have installed FENCE-Explorer do not need to re-install the application, because this issue affects the installer only.

Also note that a user who uses FENCE-Explorer with Portable Application is not affected by this vulnerability because in that case a user can specify a directory to place files before executing FENCE-Explorer. However, the executable file itself contains a DLL preloading vulnerability, therefore a user should be careful not to place a suspicious file sent by the third party in the directory.

## Products Affected

  • FENCE-Explorer for Windows V8.4.1 and earlier