5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
50.4%
Toshiba CHEC, versions 6.6, 6.7, and possibly earlier, contain a hard-coded cryptographic key.
CWE-321: Use of Hard-coded Cryptographic Key - CVE-2014-4875
Toshiba CHEC, versions 6.6, 6.7, and possibly earlier, contain a hard-coded cryptographic key in the CreateBossCredentials.jar
file. An attacker that can access the bossinfo.pro
file may be able to use the hard-coded AES key to decrypt its contents, including the BOSS database credentials.
A remote, authenticated attacker may be able to acquire privileged credentials to the BOSS database.
Apply an update
Toshiba has addressed this issue by removing CreateBossCredentials.jar
in versions 6.6 build level 4014 and 6.7 build level 4329. Users are advised to upgrade to latest version available and to ensure that the CreateBossCredentials.jar
file has been removed.
301788
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: August 06, 2014 Updated: June 02, 2015
Statement Date: June 01, 2015
Affected
`VU#301788 #1 CHEC Response
Vulnerability ID: VU#301788 Vulnerability #1
Vulnerability Name: Toshiba Checkout Environment for Consumer-Service โ CHEC
contains hardcoded DB2 password
Overview
Toshiba Global Commerce Solutionsโ self checkout application CHEC contains a
file on the Client (Lane) systems that can be de-compiled to obtain a DB2
password for the CHECโs Back Office System Server (BOSS).
Description
Toshiba Global Commerce Solutionโs self checkout application CHEC contains a
file on the Client (Lane) systems that can be de-compiled to obtain a DB2
password for the CHECโs Back Office System Server (BOSS). The jar file has
hard-coded values that can be obtained and then used in conjunction with the
logic in the jar file to decrypt the userid and password for the DB2 database
on the BOSS.
Impact
An attacker could use the DB2 password to corrupt the database on the BOSS and
prevent the Lanes from functioning properly. No sensitive data can be
accessed.
Solution
The previously-mentioned jar file is not actually used by the Lane and has been
removed in later releases of the Lane software. Install the latest version of
the Lane Application to delete the relevant file.
CHEC 6.6 fixed in build level 4014 or higher
CHEC 6.7 fixed in build level 4329 or higher
Vendor Information
VendorStatusDate NotifiedDate Updated
Toshiba Global Commerce Solutions`
We are not aware of further vendor information regarding this vulnerability.
Toshiba CHEC versions prior to 6.6 build level 4014 and 6.7 build level 4329 are affected.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23301788 Feedback>).
Group | Score | Vector |
---|---|---|
Base | 5 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Temporal | 4.3 | E:POC/RL:U/RC:UR |
Environmental | 4.5 | CDP:LM/TD:M/CR:M/IR:ND/AR:ND |
<http://cwe.mitre.org/data/definitions/321.html>
Thanks to David Odell for reporting this vulnerability.
This document was written by Todd Lewellen and Joel Land.
CVE IDs: | CVE-2014-4875 |
---|---|
Date Public: | 2015-06-08 Date First Published: |