TDSCSA00699-02: Vulnerability found related to Unquoted Search Path or Element
April 28, 2020
Toshiba Electronic Devices & Storage Corporation
Overview
There is a potential vulnerability within three backup and security software applications for the Toshiba Canvio external HDD product. Toshiba is advising customers who have installed the software to update to the new versions provided on our web site.
Affected application software and products
The following applications (which run under Windows) are affected:
Storage Backup Software, Storage Security Software and HDD Password tool (the "Applications").
The Applications run on the external HDD products as listed below. These Applications are designed to be used with these specific HDD products, but if you use them with other products, we advise that you take measures as "Solutions" below.
Application software |
Version |
Products（P/N） |
|---|---|---|
Storage Backup Software |
1.30.9116 or earlier |
CANVIO™ ADVANCE (HDTC9******A) CANVIO™ ALU / ALUMY (HDTH3******B) CANVIO™ PREMIUM (HDTW2******A) CANVIO™ SLIM (HDTD3******A) |
Storage Security Software |
1.30.8604 or earlier |
|
HDD Password tool (for Windows) |
1.20.6620 or earlier |
CANVIO™ SLIM (HDTD1******* / HDTD2*******) CANVIO™ PREMIUM (HDTW1*******) |
Note: An asterisk mark (*) is an alphanumeric character.
Impact
Each Application uses a search path that contains an unquoted element, consisting of whitespace or other separators. This can cause the product to access resources in a parent path, possibly allowing local privilege escalation.
Solutions
1) For Storage Backup Software and Storage Security Software
Customers who have installed previous versions of the Applications are advised not to run them. Please download the latest versions of the Applications from the following link.
If you use them with the products as listed, we advise you carry on "#1 Preparation before Update" and "#2-a Update Storage Backup Software and/or Storage Security Software" then "#3 Remove previous installer".
But if you use them with other products than the products as listed above, we advise that you only carry on "#2-b Uninstall Storage Backup Software and/or Storage Security Software" and "#3 Remove previous installer" in below, and do not download a new update software.
Important: Please review and follow these steps carefully for the update.
#1 Preparation before Update
- Before updating the Storage Security Software, if you own a password-protected HDD with the software, please delete the password before uninstalling.
- For both Storage Backup Software and Storage Security Software, please be sure to back up all data on the device to another computer or storage media before updating.
#2-a Update Storage Backup Software and/or Storage Security Software
When you connect the device to a computer on which the old version software is installed, the launcher will present you with an option to update the software.
#2-b Uninstall Storage Backup Software and/or Storage Security Software
Please uninstall Storage Backup Software and/or Storage Security Software.
#3 Remove previous installer
Please remove all previous versions of the installer file from the product or PC.
Software |
Version |
Release Date |
Update Classification*1 |
OS Compatibility *4 |
Download |
|---|---|---|---|---|---|
Storage Backup Software |
1.40.0410 |
April 20, 2020 |
Important |
Windows 8.1 *2 (32bit & 64bit)
Windows 10 *3 Version 1809 / Version 1903 / Version 1909 (32bit & 64bit) |
|
Storage Security Software |
1.40.0410 |
It is strongly recommended that you update this software.
Note
- Company names, product names, and service names may be trademarks of their respective companies.
- Software support language: English, Simplified Chinese, German, Spanish, French, Italian, Portuguese, Japanese
- Manual support language: English, German, Spanish, French, Italian, Portuguese.
*1 Update Classification: means Necessarily of update.
*2 Excludes Windows RT 8.1 and Windows 8.1 Enterprise Edition.
*3 Excludes Education, Pro Education, Windows 10 S, Windows 10 Mobile, Enterprise and Enterprise LTSB Edition.
*4 Toshiba has ended the support for the Windows OS versions for which Microsoft Corporation in the United States has ended the support.
2) For HDD Password tool
Customers who have installed previous versions of the HDD Password tool are advised not to run it. Please download and install the latest version from the following link.
If you use them with the products as listed, we advise you carry on “#1 Preparation before Update” and “#2-a Update HDD Password Tool” then “#3 Remove previous installer”.
But if you use them with other products than the products as listed above, we advise that you only carry on “#2-b Uninstall HDD Password Tool” and “#3 Remove previous installer” in below, and do not download a new update software.
Important: Please review and follow these steps carefully for the update.
#1 Preparation before Update
If you own password-protected HDD with the software, please delete the password before uninstalling.
#2-a Update HDD Password tool
Please download the latest version and install this.
#2-b Uninstall HDD Password tool
Please uninstall HDD Password tool.
#3 Remove previous installer
Please remove the previous version of the installer from the product or PC.
Software |
Version |
Release Date |
Update Classification*1 |
OS Compatibility*4 |
Download |
Manual |
Release Note |
|---|---|---|---|---|---|---|---|
HDD Password tool |
1.40.0410
|
April 28, 2020 |
Important |
Windows 8.1 *2 (32bit & 64bit)
Windows 10 *3 Version 1809 / Version 1903 / Version 1909 (32bit & 64bit) |
Type 1*5 (8.55 MB) Type 2*5 (11.1 MB)
|
(701 KB) |
(10.7 KB) |
It is strongly recommended that you update this software.
Note
- Company names, product names, and service names may be trademarks of their respective companies.
*1 Update Classification means necessarily of update.
*2 Exclude Windows RT 8.1 and Windows 8.1 Enterprise Edition.
*3 Excludes Education, Pro Education, Windows 10 S, Windows 10 Mobile, Enterprise and Enterprise LTSB Edition.
*4 Toshiba has ended the support for Windows OS versions for which Microsoft Corporation in the United States has ended the support.
*5 Software support language:
- There are two types of software, depending on the region. Please download the software corresponding to your region.
Type 1: Americas region / English, Canadian French, Portuguese (Brazilian) and Spanish (Latin American)
Type 2: Europe, Asia region / Chinese (Simplified), Chinese (Traditional), Korean, Japanese, English, German, French, Spanish (International), Italian, Polish, Portuguese, Russian and Turkish.
- Manual support language: English
History
Contact Information
Please visit the following website and choose the Consumer Storage Solutions website in your region.