Vulnerability in Sophos Disk Encryption
CVE-2011-5117
Sophos SafeGuard Enterprise Device Encryption 5.x through 5.50.8.13, Sophos SafeGuard Easy Device Encryption Client 5.50.x, and Sophos Disk Encryption 5.50.x have a delay before removal of (1) out-of-date credentials and (2) invalid credentials, which allows physically proximate attackers to defeat the full-disk encryption feature by leveraging knowledge of these credentials.
Vulnerability class: Race Condition
EPSS: 0.003 (26.2th percentile) — read the EPSS interpretation.
Affected products
- Sophos Disk_encryption — versions 5.50.0, 5.50.1, 5.50.8
- Sophos Safeguard_easy_device_encryption_client — versions 5.50.0, 5.50.1, 5.50.8
- Sophos Safeguard_enterprise_device_encryption — versions 5.6, 5.35.0, 5.35.1
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)