search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Toshiba CHEC contains a hard-coded cryptographic key

Vulnerability Note VU#301788

Original Release Date: 2015-06-08 | Last Revised: 2015-06-08

Overview

Toshiba CHEC, versions 6.6, 6.7, and possibly earlier, contain a hard-coded cryptographic key.

Description

CWE-321: Use of Hard-coded Cryptographic Key - CVE-2014-4875

Toshiba CHEC, versions 6.6, 6.7, and possibly earlier, contain a hard-coded cryptographic key in the CreateBossCredentials.jar file. An attacker that can access the bossinfo.pro file may be able to use the hard-coded AES key to decrypt its contents, including the BOSS database credentials.

Impact

A remote, authenticated attacker may be able to acquire privileged credentials to the BOSS database.

Solution

Apply an update

Toshiba has addressed this issue by removing CreateBossCredentials.jar in versions 6.6 build level 4014 and 6.7 build level 4329. Users are advised to upgrade to latest version available and to ensure that the CreateBossCredentials.jar file has been removed.

Vendor Information

301788
 
Expand all

Toshiba Commerce Solutions Affected

Notified:  August 06, 2014 Updated: June 02, 2015

Statement Date:   June 01, 2015

Status

Affected

Vendor Statement

VU#301788 #1 CHEC Response

Vulnerability ID: VU#301788 Vulnerability #1

Vulnerability Name: Toshiba Checkout Environment for Consumer-Service – CHEC
contains hardcoded DB2 password

Overview  

Toshiba Global Commerce Solutions’ self checkout application CHEC contains a
file on the Client (Lane) systems that can be de-compiled to obtain a DB2
password for the CHEC’s Back Office System Server (BOSS).

Description

Toshiba Global Commerce Solution’s self checkout application CHEC contains a
file on the Client (Lane) systems that can be de-compiled to obtain a DB2
password for the CHEC’s Back Office System Server (BOSS).  The jar file has
hard-coded values that can be obtained and then used in conjunction with the
logic in the jar file to decrypt the userid and password for the DB2 database
on the BOSS.

Impact

An attacker could use the DB2 password to corrupt the database on the BOSS and
prevent the Lanes from functioning properly.  No sensitive data can be
accessed.

Solution

The previously-mentioned jar file is not actually used by the Lane and has been
removed in later releases of the Lane software.  Install the latest version of
the Lane Application to delete the relevant file.

CHEC 6.6 fixed in build level 4014 or higher

CHEC 6.7 fixed in build level 4329 or higher

Vendor Information  
VendorStatusDate NotifiedDate Updated
Toshiba Global Commerce Solutions

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Addendum

Toshiba CHEC versions prior to 6.6 build level 4014 and 6.7 build level 4329 are affected.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base 5 AV:N/AC:L/Au:N/C:P/I:N/A:N
Temporal 4.3 E:POC/RL:U/RC:UR
Environmental 4.5 CDP:LM/TD:M/CR:M/IR:ND/AR:ND

References

http://cwe.mitre.org/data/definitions/321.html

Acknowledgements

Thanks to David Odell for reporting this vulnerability.

This document was written by Todd Lewellen and Joel Land.

Other Information

CVE IDs: CVE-2014-4875
Date Public: 2015-06-08
Date First Published: 2015-06-08
Date Last Updated: 2015-06-08 13:54 UTC
Document Revision: 22

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis