PT-2017-15213 · Toshiba · Flashair Configuration+5

Published 2017-04-28 · Updated 2019-10-03 · CVE-2017-2149

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool versions V1.00.03 and earlier SDHC Memory Card with embedded wireless LAN functionality FlashAir Configuration Software versions V3.0.2 and earlier SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WE series) version V3.00.01 SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WD/WC series) versions V2.00.03 and earlier SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WB/WL series) versions V1.00.04 and earlier SDHC Memory Card with embedded TransferJet functionality Configuration Software versions V1.02 and earlier SDHC Memory Card with embedded TransferJet functionality Software Update tool versions V1.00.06 and earlier

Description The issue allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory. This is due to an untrusted search path vulnerability in the installers of the affected software.

Recommendations For SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool versions V1.00.03 and earlier, update to a version later than V1.00.03. For SDHC Memory Card with embedded wireless LAN functionality FlashAir Configuration Software versions V3.0.2 and earlier, update to a version later than V3.0.2. For SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WE series) version V3.00.01, update to a version later than V3.00.01. For SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WD/WC series) versions V2.00.03 and earlier, update to a version later than V2.00.03. For SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WB/WL series) versions V1.00.04 and earlier, update to a version later than V1.00.04. For SDHC Memory Card with embedded TransferJet functionality Configuration Software versions V1.02 and earlier, update to a version later than V1.02. For SDHC Memory Card with embedded TransferJet functionality Software Update tool versions V1.00.06 and earlier, update to a version later than V1.00.06.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2017-2149

Affected Products

Flashair Configuration

Flashair Software Update Tool

Sdhc Memory Card With Embedded Transferjet Functionality Configuration

Sdhc Memory Card With Embedded Transferjet Functionality Software Update Tool

Sdhc Memory Card With Embedded Wireless Lan Functionality

Sdhc/Sdxc Memory Card With Embedded Nfc Functionality Software Update Tool

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-2149 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2149 · Vendor Advisory
• http://toshiba-personalstorage.net/news/20170414.htm · Vendor Advisory
• http://jvn.jp/en/jp/JVN05340816/index.html · Note
• http://securityfocus.com/bid/97697 · Note