PT-2014-4426 · Sophos · Sophos Enterprise Console+1

Publicado 2014-06-25 · Atualizado 2019-09-27 · CVE-2014-2005

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sophos Disk Encryption (SDE) versions 5.x Sophos Enterprise Console (SEC) versions 5.x through 5.2.1

Description The issue concerns a lack of enforcement of intended authentication requirements when resuming from sleep mode. This allows physically proximate attackers to gain desktop access without encountering a login screen.

Recommendations For Sophos Disk Encryption (SDE) versions 5.x, update to a version that includes the necessary authentication enforcement. For Sophos Enterprise Console (SEC) versions 5.x through 5.2.1, update to version 5.2.2 or later to ensure proper authentication requirements are enforced when resuming from sleep mode.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-2005

Produtos afetados

Sophos Disk Encryption

Sophos Enterprise Console

Referências · 5

• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000061 · Nota
• http://sophos.com/en-us/support/knowledgebase/121066.aspx · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN63940326/index.html · Nota
• http://securityfocus.com/bid/68169 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2005 · Nota de Segurança