JVN#62121133: Multiple directory traversal vulnerabilities in AttacheCase

AttacheCase is an open source file encryption software provided by HiBARA Software. AttacheCase contains a directory traversal vulnerability (CWE-22) due to a flaw in processing filenames in ATC files.

Impact

• Decrypting a crafted ATC file may result in creation of an arbitrary file or overwriting of an existing file - CVE-2018-0659
• Decrypting a crafted ATC file may result in creation of an arbitrary file - CVE-2018-0660

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• AttacheCase ver.2.8.4.0 and earlier
• AttacheCase ver.3.3.0.0 and earlier
  【Updated on August 31, 2018】
  This advisory was first published on August 6, 2018. At that point it was stated that the affected products were “AttacheCase ver.2.8.3.0 and earlier” and “AttacheCase ver.3.2.3.0 and earlier”.
  However, later on it was found that the updated versions “AttacheCase ver.2.8.4.0” and “AttacheCase ver.3.3.0.0” contained insufficient fixes.
  Therefore, information under [Products Affected] was modified as of as of August 31, 2018.