PT-2017-15213 · Toshiba · Flashair Configuration+5

Publicado 2017-04-28 · Atualizado 2019-10-03 · CVE-2017-2149

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool versions V1.00.03 and earlier SDHC Memory Card with embedded wireless LAN functionality FlashAir Configuration Software versions V3.0.2 and earlier SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WE series) version V3.00.01 SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WD/WC series) versions V2.00.03 and earlier SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WB/WL series) versions V1.00.04 and earlier SDHC Memory Card with embedded TransferJet functionality Configuration Software versions V1.02 and earlier SDHC Memory Card with embedded TransferJet functionality Software Update tool versions V1.00.06 and earlier

Description The issue allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory. This is due to an untrusted search path vulnerability in the installers of the affected software.

Recommendations For SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool versions V1.00.03 and earlier, update to a version later than V1.00.03. For SDHC Memory Card with embedded wireless LAN functionality FlashAir Configuration Software versions V3.0.2 and earlier, update to a version later than V3.0.2. For SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WE series) version V3.00.01, update to a version later than V3.00.01. For SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WD/WC series) versions V2.00.03 and earlier, update to a version later than V2.00.03. For SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WB/WL series) versions V1.00.04 and earlier, update to a version later than V1.00.04. For SDHC Memory Card with embedded TransferJet functionality Configuration Software versions V1.02 and earlier, update to a version later than V1.02. For SDHC Memory Card with embedded TransferJet functionality Software Update tool versions V1.00.06 and earlier, update to a version later than V1.00.06.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2017-2149

Produtos afetados

Flashair Configuration

Flashair Software Update Tool

Sdhc Memory Card With Embedded Transferjet Functionality Configuration

Sdhc Memory Card With Embedded Transferjet Functionality Software Update Tool

Sdhc Memory Card With Embedded Wireless Lan Functionality

Sdhc/Sdxc Memory Card With Embedded Nfc Functionality Software Update Tool

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-2149 · Nota de Segurança
• http://jvn.jp/en/jp/JVN05340816/index.html · Nota
• http://securityfocus.com/bid/97697 · Nota
• https://osv.dev/vulnerability/CVE-2017-2149 · Aviso do Fabricante
• http://toshiba-personalstorage.net/news/20170414.htm · Aviso do Fabricante