PT-2022-10543 · Unknown · Enc Datavault Oem+1

Boi Sletterink + 1 · Published 2022-01-02 · Updated 2022-12-13 · CVE-2021-36751

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions ENC DataVault versions 7.2.3 and before ENC DataVault OEM versions

Description The issue concerns the use of an encryption algorithm that is vulnerable to data manipulation, known as ciphertext malleability, without requiring knowledge of the key. This means an attacker can modify the ciphertext, which would result in corresponding modifications to the plaintext. There is no mechanism in place to ensure data integrity, making it impossible to detect such manipulations.

Recommendations For ENC DataVault versions 7.2.3 and before, consider disabling the use of the vulnerable encryption algorithm until a patch or update is available. For ENC DataVault OEM versions, restrict access to sensitive data stored with these versions to minimize the risk of exploitation. As a temporary workaround, avoid relying solely on the encryption provided by ENC DataVault for sensitive data, and consider additional security measures to protect against data manipulation.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2021-36751

Affected Products

Enc Datavault

Enc Datavault Oem

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-36751 · Security Note
• https://encsecurity.zendesk.com/hc/en-us/articles/7860771829533 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36751 · Vendor Advisory
• https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software · Vendor Advisory
• https://t.me/cibsecurity/34822 · Telegram Post
• https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3 · Note
• https://t.me/cvenotify/38447 · Telegram Post
• https://t.me/cvenotify/39767 · Telegram Post