Fujitsu PaperStream IP 1.42.0.5685 FJTWSVIC Service UninOldIS.dll ChangeUninstallString PATH untrusted search path

Summaryinfo

A vulnerability, which was classified as critical, has been found in Fujitsu PaperStream IP 1.42.0.5685. This vulnerability affects the function ChangeUninstallString in the library UninOldIS.dll of the component FJTWSVIC Service. Performing a manipulation of the argument PATH as part of Named Pipe results in untrusted search path. This vulnerability is identified as CVE-2018-16156. The attack is only possible with local access. Additionally, an exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in Fujitsu PaperStream IP 1.42.0.5685. This affects the function ChangeUninstallString in the library UninOldIS.dll of the component FJTWSVIC Service. The manipulation of the argument PATH as part of a Named Pipe leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over the FjtwMkic_Fjicube_32 named pipe. One of these message processing functions attempts to dynamically load the UninOldIS.dll library and executes an exported function named ChangeUninstallString. The default install does not contain this library and therefore if any DLL with that name exists in any directory listed in the PATH variable, it can be used to escalate to SYSTEM level privilege.

The weakness was released 05/17/2019. This vulnerability is uniquely identified as CVE-2018-16156 since 08/29/2018. Attacking locally is a requirement. The successful exploitation needs a authentication. Technical details and a public exploit are known. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (49382). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Fujitsu

Name

• PaperStream IP

Version

• 1.42.0.5685

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion