Title

Smart Card Readers (SCRs) used with smartphone must have required software version installed. (Cat III impact)

Discussion

Required security features are not available in earlier software versions. In addition, there may be known vulnerabilities in earlier versions.

Check Content

Detailed Policy Requirements: SCR: Biometric Associates, LP (BAL) baiMobile BAL-3000MP Bluetooth Smart Card Reader. Firmware version v2.01.00 or later should be used (version v2.02.00 is recommended). Check Procedures: Check a sample of site readers (3-4). The version of the reader firmware is displayed when the user presses and holds the Action button for a couple of seconds. Mark as a finding if the firmware version on the SCR is not the approved version.

Fix Text

Install required SCR software version.

Additional Identifiers

Rule ID: SV-35012r1_rule

Vulnerability ID: V-24982

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.