|
[Japanese]
|
JVNDB-2020-000025
|
Toshiba Electronic Devices & Storage software registers unquoted service paths
|
|
Some of Toshiba Electronic Devices & Storage software registers Windows services with unquoted file paths (CWE-428).
Toshiba Electronic Devices & Storage Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.
JPCERT/CC and TOSHIBA ELECTRONIC DEVICES & STORAGE CORPORATION coordinated under the Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 8.4 (High) [IPA Score]
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
CVSS V2 Severity:
Base Metrics 4.6 (Medium) [IPA Score]
- Access Vector: Local
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: Partial
- Availability Impact: Partial
|
|
HDD Password tool (for Windows) version 1.20.6620 and earlier which are stored in the devices listed below and were downloaded before 2020 May 10 are affected:
|
Toshiba Electronic Devices & Storage Corporation
- CANVIO PREMIUM 3TB HD-MB30TY
- CANVIO PREMIUM 3TB HD-MA30TY
- CANVIO PREMIUM 3TB HD-MB30TS
- CANVIO PREMIUM 3TB HD-MA30TS
- CANVIO PREMIUM 2TB HD-MB20TY
- CANVIO PREMIUM 2TB HD-MA20TY
- CANVIO PREMIUM 2TB HD-MB20TS
- CANVIO PREMIUM 2TB HD-MA20TS
- CANVIO PREMIUM 1TB HD-MB10TY
- CANVIO PREMIUM 1TB HD-MA10TY
- CANVIO PREMIUM 1TB HD-MB10TS
- CANVIO PREMIUM 1TB HD-MA10TS
- CANVIO SLIM 1TB HD-SB10TK
- CANVIO SLIM 1TB HD-SB10TS
- CANVIO SLIM 500GB HD-SB50GK
- CANVIO SLIM 500GB HD-SA50GK
- CANVIO SLIM 500GB HD-SB50GS
- CANVIO SLIM 500GB HD-SA50GS
|
|
|
When a registered path contains spaces, and a malicious executable is placed on a certain path, it may be executed with the privilege of the Windows service.
|
|
The developer released the update that contains a fix for this vulnerability on 2020 April 28.
[Uninstall and/or update HDD Password tool (for Windows) version 1.20.6620]
Unintall HDD Password tool (for Windows) version 1.20.6620 and/or update it to the latest version if you continue using it according to the information provided by the developer.
Uninstalling or applying the update will delete/fix the registration of improper Windows services.
How to uninstall:
*Delete the password if it is set before uninstalling HDD Password tool (for Windows) version 1.20.6620 and earlier
*Uninstall the affected software from the PC if installed
*Delete the installer of the affected software
How to update:
*Update the software to the latest version
For more information, refer to the information provided by the developer.
|
|
Toshiba Electronic Devices & Storage Corporation
|
|
- Unquoted Search Path or Element(CWE-428) [NVD Evaluation]
|
|
- CVE-2020-5569
|
|
- JVN : JVN#13467854
- National Vulnerability Database (NVD) : CVE-2020-5569
|
|
- [2020/04/20]
Web page was published
[2020/04/28]
Solution was modified
|
