A vulnerability has been reported in Hyper Estraier, which can be exploited by malicious users to cause a DoS (Denial of Service) or to gain knowledge of certain sensitive information.

The vulnerability is caused due to an error in handling files with certain unicode characters in their filenames when creating the index of a searchable directory. This can be exploited to cause files in non-searchable directories to be indexed, potentially disclosing their contents. It is also possible to cause a DoS by causing the index creation to fail via a file with a specially crafted unicode filename.

Successful exploitation requires that the malicious user is able to upload a file into a searchable directory.

The vulnerability affects only the Windows version.

Solution
Update to version 1.0.2.
Further details available in Customer Area

Provided and/or discovered by
Yosuke Hasegawa

Changelog
Further details available in Customer Area

Original Advisory
JP Vendor Status Notes (Japanese):
http://jvn.jp/jp/JVN%2318282718/index.html

IPA (Japanese):
http://www.ipa.go.jp/security/vuln/documents/2005/JVN_18282718_HyperEstraier.html

Deep Links
Links available in Customer Area