PT-2010-2024 · Kingston · Kingston Datatraveler Blackbox+2

Published 2010-01-07 · Updated 2018-08-13 · CVE-2010-0223

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kingston DataTraveler BlackBox (DTBB) Kingston DataTraveler Secure Privacy Edition (DTSP) Kingston DataTraveler Elite Privacy Edition (DTEP)

Description The issue allows physically proximate attackers to access the cleartext drive contents by providing a key that was captured in a USB data stream at an earlier time, due to the lack of prevention of password replay attacks.

Recommendations For Kingston DataTraveler BlackBox (DTBB), consider using additional security measures to protect against password replay attacks until a fix is available. For Kingston DataTraveler Secure Privacy Edition (DTSP), restrict access to sensitive data stored on the device to minimize the risk of exploitation. For Kingston DataTraveler Elite Privacy Edition (DTEP), avoid using the device for storing sensitive information until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-0223

Affected Products

Kingston Datatraveler Blackbox

Kingston Datatraveler Elite Privacy Edition

Kingston Datatraveler Secure Privacy Edition

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2010-0223 · Security Note
• http://kingston.com/driveupdate · Vendor Advisory
• http://vupen.com/english/advisories/2010/0080 · Note
• http://syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9 · Note
• http://syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_Kingston_USB-Stick.pdf · Note
• https://ironkey.com/usb-flash-drive-flaw-exposed · Note