PT-2014-4426 · Sophos · Sophos Enterprise Console+1

Published 2014-06-25 · Updated 2019-09-27 · CVE-2014-2005

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sophos Disk Encryption (SDE) versions 5.x Sophos Enterprise Console (SEC) versions 5.x through 5.2.1

Description The issue concerns a lack of enforcement of intended authentication requirements when resuming from sleep mode. This allows physically proximate attackers to gain desktop access without encountering a login screen.

Recommendations For Sophos Disk Encryption (SDE) versions 5.x, update to a version that includes the necessary authentication enforcement. For Sophos Enterprise Console (SEC) versions 5.x through 5.2.1, update to version 5.2.2 or later to ensure proper authentication requirements are enforced when resuming from sleep mode.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-2005

Affected Products

Sophos Disk Encryption

Sophos Enterprise Console

References · 5

• http://sophos.com/en-us/support/knowledgebase/121066.aspx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2005 · Security Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000061 · Note
• http://jvn.jp/en/jp/JVN63940326/index.html · Note
• http://securityfocus.com/bid/68169 · Note