Toshiba Electronic Devices & Storage Corporation - There is a potential vulnerability with three backup and security software applications for the Toshiba Canvio external HDD product. Toshiba is advising customers who have installed the software to update to the new versions provided on our web site.

Affected application software and products

The following applications (which run under Windows) are affected:

Storage Backup Software, Storage Security Software and HDD Password tool (the 'Applications').

The Applications run on the external HDD products as listed below. These Applications are designed to be used with these specific HDD products, but if you use them with other products, we advise that you take measures as 'Solutions' below.

Application software

Version

Products(P/N)

Storage Backup Software

1.30.9116 or earlier

CANVIO ADVANCE (HDTC9******A)

CANVIO ALU / ALUMY (HDTH3******B)

CANVIO PREMIUM (HDTW2******A)

CANVIO SLIM (HDTD3******A)

Storage Security Software

1.30.8604 or earlier

HDD Password tool

(for Windows)

1.20.6620 or earlier

CANVIO SLIM (HDTD1******* / HDTD2*******)

CANVIO PREMIUM (HDTW1*******)

Note: An asterisk mark (*) is an alphanumeric character.

Impact

Each Application uses a search path that contains an unquoted element, consisting of whitespace or other separators. This can cause the product to access resources in a parent path, possibly allowing local privilege escalation.

Solutions

1)	For Storage Backup Software and Storage Security Software

Customers who have installed previous versions of the Applications are advised not to run them. Please download the latest versions of the Applications from the following link.

If you use them with the products as listed, we advise you carry on '#1 Preparation before Update' and '#2-a Update Storage Backup Software and/or Storage Security Software' then '#3 Remove previous installer'.

But if you use them with other products than the products as listed above, we advise that you only carry on '#2-b Uninstall Storage Backup Software and/or Storage Security Software' and '#3 Remove previous installer' in below, and do not download a new update software.

Important: Please review and follow these steps carefully for the update.

#1 Preparation before Update

Before updating the Storage Security Software, if you own a password-protected HDD with the software, please delete the password before uninstalling.

For both Storage Backup Software and Storage Security Software, please be sure to back up all data on the device to another computer or storage media before updating.

#2-a Update Storage Backup Software and/or Storage Security Software

When you connect the device to a computer on which the old version software is installed, the launcher will present you with an option to update the software.

#2-b Uninstall Storage Backup Software and/or Storage Security Software

Please uninstall Storage Backup Software and/or Storage Security Software.

#3 Remove previous installer

Please remove all previous versions of the installer file from the product or PC.

Software Version:

See details at: 	https://toshiba.semicon-storage.com/ap-en/storage/support/security-advisories/storage-20200420-1.html

Note

Company names, product names, and service names may be trademarks of their respective companies.

Software support language: English, Simplified Chinese, German, Spanish, French, Italian, Portuguese, Japanese

Manual support language: English, German, Spanish, French, Italian, Portuguese.

*1 Update Classification: means Necessarily of update.

*2 Excludes Windows RT 8.1 and Windows 8.1 Enterprise Edition.

*3 Excludes Education, Pro Education, Windows 10 S, Windows 10 Mobile, Enterprise and Enterprise LTSB Edition.

*4 Toshiba has ended the support for the Windows OS versions for which Microsoft Corporation in the United States has ended the support.

2)	For HDD Password tool

Customers using version 1.20.6620 or earlier are advised to uninstall the software to avoid issues relating to the Application vulnerability. A new update is expected to be available for download on April 28, 2020.

If you use them with the products as listed, we advise you carry on '#1 Preparation before Uninstall' and '#2 Uninstall software' then '#3 Remove installer file of HDD Password tool'.

If you use them with other products than the products as listed above, we advise that you only carry on '#2 Uninstall software' and '#3 Remove installer file of HDD Password tool' in the below, and do not download a new update software.

Important: Please review and follow these steps carefully

#1 Preparation before Uninstall

If you have a password-protected HDD with the password set using the software, please remove the password protection before uninstalling.

#2 Uninstall software

Please uninstall HDD Password tool.

#3 Remove installer file of HDD Password tool

Please remove the previous version of the installer file from the product or PC.

History

Date

Contact Information

Please visit the following website and choose the Consumer Storage Solutions website in your region.

(C) 2020 Electronic News Publishing, source ENP Newswire