JVN#81659403: Installer of Qua station connection tool for Windows may insecurely load Dynamic Link Libraries

Qua station provided KDDI CORPORATION is a 4G LTE photostrage. Qua station connection tool is used to view data saved on Qua station from a PC and/or save data on a PC. Installer of Qua station connection tool for Windows contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427).

Impact

Arbitrary code may be executed with the privilege of the user invoking the installer.

Solution

Use the latest installer
Use the latest installer according to the information provided by the developer.
The developer states this vulnerability was addressed in the installer of Qua station connection tool for Windows released on 2017 June 22 at 16:00 JST (UTC/GMT + 9hours).
Users who already have installed Qua station connection tool for Windows do not need to re-install the application, because this issue affects the installer only.

Products Affected

• Qua station connection tool for Windows version 1.00.03