CVE-2017-10850 Other in Installer of ART EX Direct FAX Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271
Attackers can gain privileges by placing a malicious DLL in a directory searched by the printer driver installer due to untrusted search path issues.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-10850?
CVE-2017-10850 is a high-severity vulnerability in Fuji Xerox Co.,Ltd. Installer of ART EX Direct FAX Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, published on 1 Sep 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Untrusted search path vulnerability in Installers of ART EX Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271 (Timestamp of code signing is before 12 Apr 2017 02:04 UTC.), PostScript? Driver + Additional Feature Plug-in + PPD File for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271 (Timestamp of code signing is before 12 Apr 2017 02:10 UTC.), XPS Print Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271 (Timestamp of code signing is before 3 Nov 2017 23:48 UTC.), ART EX Direct FAX Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271 (Timestamp of code signing is before 26 May 2017 07:44 UTC.), Setting Restore Tool for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271 (Timestamp of code signing is before 25 Aug 2015 08:51 UTC.) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Weakness: CWE-426
Which versions are affected by CVE-2017-10850?
It affects 2 products.
Products include Fujifilm Apeosport-Vi, Fujifilm Docucentre-Vi.
How do I fix CVE-2017-10850?
No fix has been published for CVE-2017-10850 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-10850 being exploited?
There is no known exploitation of CVE-2017-10850 in the wild and no public exploit code.
Sources
Also known as GHSA-v8xq-v2w7-r84c.