CVE-2011-5117

Published: Aug 24, 2012Modified: Apr 29, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

Sophos SafeGuard Enterprise Device Encryption 5.x through 5.50.8.13, Sophos SafeGuard Easy Device Encryption Client 5.50.x, and Sophos Disk Encryption 5.50.x have a delay before removal of (1) out-of-date credentials and (2) invalid credentials, which allows physically proximate attackers to defeat the full-disk encryption feature by leveraging knowledge of these credentials.

Affected (15)

Products: Sophos: Safeguard Enterprise Device Encryption, Safeguard Easy Device Encryption Client, Disk Encryption

Sophos

3 products

Safeguard Enterprise Device Encryption

Safeguard Easy Device Encryption Client

Disk Encryption

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Sophos Safeguard Enterprise Device Encryption	Version 5.35.0
Sophos Safeguard Enterprise Device Encryption	Version 5.35.1
Sophos Safeguard Enterprise Device Encryption	Version 5.35.2
Sophos Safeguard Enterprise Device Encryption	Version 5.35.3
Sophos Safeguard Enterprise Device Encryption	Version 5.40.0
Sophos Safeguard Enterprise Device Encryption	Version 5.50.0
Sophos Safeguard Enterprise Device Encryption	Version 5.50.1
Sophos Safeguard Enterprise Device Encryption	Version 5.50.8
Sophos Safeguard Enterprise Device Encryption	Version 5.6

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Sophos Safeguard Easy Device Encryption Client	Version 5.50.0
Sophos Safeguard Easy Device Encryption Client	Version 5.50.1
Sophos Safeguard Easy Device Encryption Client	Version 5.50.8

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Sophos Disk Encryption	Version 5.50.0
Sophos Disk Encryption	Version 5.50.1
Sophos Disk Encryption	Version 5.50.8

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (2)

http://www.sophos.com/en-us/support/knowledgebase/112655.aspx

Source: cve@mitre.org

PatchVendor Advisory

http://www.sophos.com/en-us/support/knowledgebase/112655.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.