Vulnerability Note VU#948155
Henry Schein Dentrix G5 uses hard-coded database credentials shared across multiple installations
Henry Schein Dentrix G5, a dental practice management software suite, uses hard-coded database access credentials that are shared across multiple installation sites. An attacker who is able to obtain the credentials for one site may be able to gain access to other sites using the same credentials.
Dentrix G5 has uses hard-coded credentials (CWE-798) to access a database back-end. The credentials are the same across installations of Dentrix G5. Sensitive patient information is contained in Dentrix G5 databases. An administrator is unable to change these credentials without breaking access to the back-end database. Henry Schein has provided a vendor statement with additional details about this vulnerability.
An attacker who is able to obtain the database credentials from one site can potentially access databases on other sites sharing the same credentials. The attacker may need access to the local network or a system with Dentrix G5 installed in order to obtain the credentials, and the attacker would need network access to the database in order to obtain sensitive patient information.
Apply an Update
Dentrix G5 version 15.1.294 (Dentrix G5.1 Hotfix 1, released 14 Feb 2013) addresses this vulnerability. This update adds a feature to create a unique database back-end password for each Dentrix G5 installation. The update also makes it more difficult to obtain the password from a Dentrix G5 system or the network. Contact Henry Schein customer service for additional information.
Restrict Network Access
Vendor Information (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Henry Schein||Affected||15 Oct 2012||28 Apr 2013|
CVSS Metrics (Learn More)
Thanks to Justin Shafer for reporting this vulnerability.
This document was written by Jared Allar.
- CVE IDs: CVE-2012-4952
- Date Public: 22 Nov 2012
- Date First Published: 26 Apr 2013
- Date Last Updated: 08 Sep 2015
- Document Revision: 36
If you have feedback, comments, or additional information about this vulnerability, please send us email.