Kingston DataTraveler USB Flash Drives Access Control Security Bypass Vulnerability

Bugtraq ID:	44173
Class:	Design Error
CVE:	CVE-2010-0221 CVE-2010-0222 CVE-2010-0223
Remote:	No
Local:	Yes
Published:	Dec 21 2009 12:00AM
Updated:	Dec 21 2009 12:00AM
Credit:	Matthias Deeg and Sebastian Schreiber (SySS)
Vulnerable:	Kingston Technology Company DataTraveler Elite �?? Privacy Edition (DTEP) 0 Kingston Technology Company DataTraveler BlackBox 0
Not Vulnerable:

Kingston DataTraveler USB Flash Drives Access Control Security Bypass Vulnerability

Kingston DataTraveler USB flash drives are prone to a local security-bypass vulnerability.

Attackers with physical access to an affected drive can exploit this issue to bypass password protection mechanisms to obtain data stored on the device.

The following devices are affected:

DataTraveler BlackBox (DTBB)
DataTraveler Secure â?? Privacy Edition (DTSP)
DataTraveler Elite â?? Privacy Edition (DTEP)

Kingston DataTraveler USB Flash Drives Access Control Security Bypass Vulnerability

To exploit this issue, an attacker would need physical access to the affected device.

Kingston DataTraveler USB Flash Drives Access Control Security Bypass Vulnerability

References:

• Cryptographically Secure? SySS Cracks a USB Flash Drive (Kingston) (Matthias Deeg and Sebastian Schreiber (SySS))
  
• Kingston's Secure USB Drive Information Page (Kingston Technology)
  
• SySS Cracks Crypto System (SySS)