# Tera Term installer has vulnerability of DLL loading without intent

Last Update: June 1, 2017

## Overview

The installer of Tera Term 4.94 or earlier has vulnerability of DLL loading without intent.
When this vulnerability is used for bad ends, a malicious third person will execute any code on installer startup.

This vulnerability only affects on installer startup, so Tera Term already installed does not have the problem.
Newly, please use below method when Tera Term is installed.

## Affected version

The installer of Tera Term 4.94 or earlier.
The zip archive can not be affected.

## Impact

Any DLL file may be loaded without intent on installer startup.
The DLL file that a malicious third person stores into the installer directory will be loaded,
and then any code will be executed.

Tera Term already installed does not have the problem because this vulnerability only affects on installer startup.

## Solution

Please use the latest installer when installing or upgrading the Tera Term.

## Workaround

Please use below method to install an older version.

- Use zip archive.
- Make a new folder and move the installer file into it. Next, execute the file.

## References

- JVNTA#91240916 Insecure DLL Loading and Command Execution Issues on Many Windows Application Programs
- JVN#06770361 Installer of Tera Term may insecurely load Dynamic Link Libraries

## Acknowledgment

Thank you for Eiri Masami of Tachibana General Laboratories, IPA and JPCERT/CC relationship.

## History

- May 31, 2017 First release
- June 1, 2017 Added a link to JVN vulnerability report

## Contact

Email: ttssh2-nospam-securitylists.osdn.me