Multiple Sophos SafeGuard Products Credential Management Security Bypass Vulnerability

Bugtraq ID:	45336
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Dec 10 2010 12:00AM
Updated:	Dec 10 2010 12:00AM
Credit:	Sophos
Vulnerable:	Sophos SafeGuard Enterprise Device Encryption 5.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Sophos Easy Device Encryption Client 5.50.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Sophos Disk Encryption 5.50.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:

Multiple Sophos SafeGuard Products Credential Management Security Bypass Vulnerability

Sophos SafeGuard Products are prone to a security-bypass vulnerability.

An attacker can exploit this issue to perform unauthorized actions, which may aid in further attacks.

The following Sophos products are vulnerable:

SafeGuard Enterprise Device Encryption 5.x
SafeGuard Easy Device Encryption Client 5.50.x
Sophos Disk Encryption 5.50.x

Multiple Sophos SafeGuard Products Credential Management Security Bypass Vulnerability

Attackers need local interactive access to the affected computer to exploit this issue.

Multiple Sophos SafeGuard Products Credential Management Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.

Multiple Sophos SafeGuard Products Credential Management Security Bypass Vulnerability

References:

• Sophos Homepage (Sophos)
  
• SafeGuard Enterprise - Sophos releases patch for potential vulnerabilty in SGN 5 (Sophos)