PT-2015-3783 · Toshiba+1 · Toshiba Chec+3

David Odell · Publicado 2015-06-24 · Atualizado 2015-06-24 · CVE-2014-4875

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Toshiba CHEC versions prior to 6.6 build 4014 Toshiba CHEC versions 6.7 prior to build 4329

Description The issue concerns a hardcoded AES key in CreateBossCredentials.jar, which can be exploited by attackers to obtain Back Office System Server (BOSS) DB2 database credentials. This can be achieved by leveraging knowledge of the hardcoded key in conjunction with read access to bossinfo.pro.

Recommendations For versions prior to 6.6 build 4014, update to a version that includes build 4014 or later to resolve the issue. For versions 6.7 prior to build 4329, update to a version that includes build 4329 or later to resolve the issue. As a temporary workaround, consider restricting read access to bossinfo.pro to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-255

CWE-200

Identificadores relacionados

CVE-2014-4875

Produtos afetados

Boss

Createbosscredentials.Jar

Db2

Toshiba Chec

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-4875 · Nota de Segurança
• http://kb.cert.org/vuls/id/301788 · Nota
• http://kb.cert.org/vuls/id/JLAD-9X4SPN · Nota