SB2022010303 - Multiple vulnerabilities in ENC DataVault and VaultAPI

Description

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2021-36750)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the mishandling of key derivation. A remote attacker can determine the passwords of all DataVault users.

2) Missing Encryption of Sensitive Data (CVE-ID: CVE-2021-36751)

CWE-ID: CWE-311 - Missing Encryption of Sensitive Data

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to an inappropriate encryption algorithm. A remote attacker can make ciphertext modifications that are reflected in modified plaintext.

Remediation

Install update from vendor's website.

References

• https://www.encsecurity.com/solutions.php
• https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-Software
• https://www.westerndigital.com/en-ap/support/product-security/wdc-21014-sandisk-secureaccess-software-update
• https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/