Sophos Disk Encryption vulnerable to authentication bypass


Sophos Disk Encryption contains an authentication bypass vulnerability.

Sophos Disk Encryption is a product to encrypt hard disk data on Windows PC. By default, Window requires logon authentication when the PC wakes up from hibernation or sleep mode. When Sophos Disk Encryption is installed, no authentication is required before operating the PC.

Cybozu Inc. Security Incident Response Team reported this vulnerability to the developer.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 4.7 (Medium) [IPA Score]
  • Access Vector: Local
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: Complete
  • Integrity Impact: None
  • Availability Impact: None
Affected Products

Sophos Ltd.
  • Sophos Disk Encryption 5.61 managed through Sophos Enterprise Console (SEC) Ver. 5.1, 5.2, 5.2.1 and 5.2.1R2


An unauthenticated attacker may compromise the computer and gain control over it.

[Update the Software]
Update Sophos Enterprise Console (SEC) to 5.2.2 or later version according to the information provided by the developer.

[Apply the workaround]
The following workaround may mitigate the affects of this vulnerability.

* Edit Group policy or Local Group Policy depending on the Windows network environment (domain / workgroup).

For more information, please refer to the developer's website.
Vendor Information

Sophos Ltd.
CWE (What is CWE?)

  1. Improper Authentication(CWE-287) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2014-2005

  1. JVN : JVN#63940326
  2. National Vulnerability Database (NVD) : CVE-2014-2005
  3. IPA SECURITY ALERTS : Security Alert for Sophos Disk Encryption vulnerable to authentication bypass (JVN#63940326) (in Japanese)
Revision History

  • [2014/06/24]
      Web page was published
      Vendor Information : Content was added
      References : Content was added