SoftBank Wi-Fi Spot Config Software Vulnerability (CVE-2013-2310) User Info Leak

Vulnerability Key Information Overview Title: Wi-Fi Spot Configuration Software vulnerability in the connection process ID: JVN#85371480 Release Date: 2013/05/15 Last Updated: 2013/05/15 Affected Products The Wi-Fi spot configuration software provided by SoftBank contains a vulnerability. Certain Wi-Fi-enabled device models such as SoftBank, WILLCOM, and Disney Mobile on SoftBank are affected. Description A vulnerability exists in the Wi-Fi spot configuration software during the process of connecting to a Wi-Fi access point, which may result in user information being inadvertently transmitted. Impact When connecting to a Wi-Fi access point, an attacker may be able to obtain user information. Solution Update software: SoftBank has released a corrected version of the software. Users should update to the latest version as provided by the developer or distributor. Vendor Status Vulnerability Analysis Access Requirements: Must be attacked from the local segment, such as Ethernet, Bluetooth, or 802.11 attacks. Authentication: Anonymous or no authentication (IP address does not count). User Interaction Requirements: The vulnerability can be exploited without any action taken by an honest user. Exploit Complexity: Requires some expertise and/or luck (e.g., buffer overflow, correct guess of small space, knowledge of Windows function calls). References and Attribution Masashi Sakai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under the Information Security Early Warning Partnership. Additional Information Referenced CVE ID: CVE-2013-2310 Referenced JVN iPed ID: JVND-2013-000039 Analysis Measures Description Specific descriptions of each analysis measure can be viewed via the provided links.

Goal Reached Thanks to every supporter — we hit 100%!

SoftBank Wi-Fi Spot Config Software Vulnerability (CVE-2013-2310) User Info Leak