Published:2017/05/16  Last Updated:2017/05/16

JVN#46372675
FlashAir fails to restrict access permissions in PhotoShare

Overview

FlashAirTM provided by Toshiba Corporation fails to restrict access permissions in PhotoShare function.

Products Affected

  • FlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier
  • FlashAirTM SDHC Memory Card (SD-WD/WC Series <W-02>) V2.00.04 and earlier
For more details, refer to the information provided by the developer.

Description

FlashAirTM by Toshiba Corporation is an SDHC memory card which provides wireless LAN access functions. FlashAirTM PhotoShare function enables to share the selected data with other users as it switches the original wireless LAN connection set by FlashAirTM default to the wireless LAN connection for PhotoShare.

FlashAirTM fails to restrict access permissions (CWE-425) in PhotoShare.

Impact

A user who access PhotoShare may obtain image data that are set not to be shared with other users.

Because of the vulnerability stated in JVN#81820501, when enabling PhotoShare with web browsers, an attacker with access to the wireless LAN may obtain these image data.

Solution

Update the software and configure appropriate wireless LAN setting
Update to the latest software versions of the product using the latest version of FlashAirTM Software Update tool (V3.00.02 or V2.00.04), and set SSID and password using appropriate application (either for Android or iOS) to prevent unintended accesses.
For more details, refer to the information provided by the developer.

Vendor Status

Vendor Link
Toshiba Corporation Photoshare of FlashAir™ may have a security vulnerability to access restriction
SDHC Memory Card with embedded wireless LAN functionality FlashAir™ (SD-WE series<W-03>)
SDHC Memory Card with embedded wireless LAN functionality FlashAir™ (SD-WD/WC series<W-02>)
How to Use the Photoshare function

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score: 3.5
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:A/AC:L/Au:S/C:P/I:N/A:N
Base Score: 2.7
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Credit

Takayoshi Isayama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2017-2161
JVN iPedia JVNDB-2017-000090