Ibas ExpertEraser Improper Disk Wipe Vulnerability

Bugtraq ID:	13611
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	May 12 2005 12:00AM
Updated:	May 12 2005 12:00AM
Credit:	Discovery is credited to Arne Vidström.
Vulnerable:	Ibas ExpertEraser 2.0
Not Vulnerable:

Ibas ExpertEraser Improper Disk Wipe Vulnerability

ExpertEraser is reported prone to a vulnerability that causes the application to improperly wipe a hard disk.

Reportedly, the application fails to completely wipe a hard disk when the disk has been configured using Device Configuration Overlay (DCO).

This issue could lead to a false sense of security and allow an attacker to harvest potentially sensitive information from a hard disk.

All versions of ExpertEraser 2.0 prior to May 13, 2005 are affected by this issue.

Ibas ExpertEraser Improper Disk Wipe Vulnerability

An exploit is not required.

Ibas ExpertEraser Improper Disk Wipe Vulnerability

Solution:
The vendor is planning to address this issue in a new version of ExpertEraser 2.0 due to be released on May 13, 2005. Please contact the vendor for more information.

Ibas ExpertEraser Improper Disk Wipe Vulnerability

References:

• Commonly used disk imaging and wiping tools can be tricked to miss parts of a (=?ISO-8859-1?Q?Arne_Vidstr=F6m?= )
  
• Re: Commonly used disk imaging and wiping tools can be tricked to miss parts of (Thor Arne Johansen )