Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2010-0225

SanDisk Cruzer Enterprise USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easier for physically proximate attackers to read or modify data by determining and providing this key.

Published

2010-01-07T19:30:00.607

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.6 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

3.9

Impact Score

6.4

Weaknesses

Type: Primary
CWE-312

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	sandisk	cruzer_enterprise_firmware	-	Yes
Hardware	sandisk	cruzer_enterprise	-	No

References

http://blogs.zdnet.com/hardware/?p=6655 Broken Link ([email protected])
http://it.slashdot.org/story/10/01/05/1734242/ Third Party Advisory ([email protected])
http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html Third Party Advisory ([email protected])
http://www.sandisk.com/business-solutions/enterprise/technical-support/security-bulletin-december-2009 Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/37677 Third Party Advisory, VDB Entry ([email protected])
http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_SanDisk_USB-Stick.pdf Broken Link ([email protected])
http://www.syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9 ([email protected])
http://www.vupen.com/english/advisories/2010/0078 Third Party Advisory ([email protected])
https://www.ironkey.com/usb-flash-drive-flaw-exposed Broken Link ([email protected])
http://blogs.zdnet.com/hardware/?p=6655 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://it.slashdot.org/story/10/01/05/1734242/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.sandisk.com/business-solutions/enterprise/technical-support/security-bulletin-december-2009 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/37677 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_SanDisk_USB-Stick.pdf Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://www.syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2010/0078 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.ironkey.com/usb-flash-drive-flaw-exposed Broken Link (af854a3a-2127-422b-91ae-364da2661108)