PT-2015-4300 · Panasonic · Panasonic Arbitrator Back-End Server (Bes) Mk 3.0 Vpu+1

Published 2015-01-15 · Updated 2015-01-16 · CVE-2014-9596

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Panasonic Arbitrator Back-End Server (BES) MK 2.0 VPU versions prior to 9.3.1 build 4.08.003.0 Panasonic Arbitrator Back-End Server (BES) MK 3.0 VPU versions prior to 9.3.1 build 5.06.000.0

Description The issue allows remote attackers to obtain sensitive information by sniffing the network for client-server traffic when certain network settings are enabled. This can lead to the exposure of sensitive data, such as Active Directory credential information.

Recommendations For Panasonic Arbitrator Back-End Server (BES) MK 2.0 VPU versions prior to 9.3.1 build 4.08.003.0, update to version 9.3.1 build 4.08.003.0 or later to resolve the issue. For Panasonic Arbitrator Back-End Server (BES) MK 3.0 VPU versions prior to 9.3.1 build 5.06.000.0, update to version 9.3.1 build 5.06.000.0 or later to resolve the issue. As a temporary workaround, consider disabling USB Wi-Fi or Direct LAN for MK 2.0 VPU and Embedded Wi-Fi or Direct LAN for MK 3.0 VPU until a patch is applied.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-9596

Affected Products

Panasonic Arbitrator Back-End Server (Bes) Mk 2.0 Vpu

Panasonic Arbitrator Back-End Server (Bes) Mk 3.0 Vpu

References · 3

• http://us2.campaign-archive1.com/?u=8c9cff2e712e3b7d09a07ecef&id=21f059b3ab · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9596 · Security Note
• http://kb.cert.org/vuls/id/117604 · Note