Out-of-Bounds Read in V-SFT VS6MemInIF Causes Data Disclosure

Mitigation Strategies

The vendor FUJI ELECTRIC CO., LTD. has addressed this vulnerability in V-SFT version 6.2.11.0.

• Update V-SFT software to version 6.2.11.0 or later.
• Avoid opening untrusted or crafted V7 files that could trigger the vulnerability.
• Implement local access controls to limit who can open V7 files on affected systems.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can lead to information disclosure, meaning that an attacker could gain access to sensitive data from the affected product. The CVSS scores indicate a high severity with impacts on confidentiality, integrity, and availability, suggesting that the vulnerability could allow unauthorized information access and potentially disrupt normal operations.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in V-SFT versions 6.2.10.0 and earlier. It is an out-of-bounds read issue found in the function VS6MemInIF!set_temp_type_default. When a specially crafted V7 file is opened, this flaw may cause the software to read memory outside the intended boundaries, potentially leading to the disclosure of sensitive information.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects V-SFT versions 6.2.10.0 and prior when opening a crafted V7 file, leading to information disclosure. Detection involves identifying if the vulnerable version of V-SFT software is present on your system.

Since the vulnerability is triggered by opening a crafted V7 file, monitoring or scanning for such files being opened or transferred locally could help detect exploitation attempts.

No specific detection commands or network signatures are provided in the available information.

Useful 0 Not Useful 0