CVE-2010-0225

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

SanDisk Cruzer Enterprise USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easier for physically proximate attackers to read or modify data by determining and providing this key.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blogs.zdnet.com/hardware/?p=6655Broken Link
http://it.slashdot.org/story/10/01/05/1734242/Third Party Advisory
http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.htmlThird Party Advisory
http://www.sandisk.com/business-solutions/enterprise/technical-support/security-bulletin-december-2009Vendor Advisory
http://www.securityfocus.com/bid/37677Third Party Advisory, VDB Entry
http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_SanDisk_USB-Stick.pdfBroken Link
http://www.syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9
http://www.vupen.com/english/advisories/2010/0078Third Party Advisory
https://www.ironkey.com/usb-flash-drive-flaw-exposedBroken Link
http://blogs.zdnet.com/hardware/?p=6655Broken Link
http://it.slashdot.org/story/10/01/05/1734242/Third Party Advisory
http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.htmlThird Party Advisory
http://www.sandisk.com/business-solutions/enterprise/technical-support/security-bulletin-december-2009Vendor Advisory
http://www.securityfocus.com/bid/37677Third Party Advisory, VDB Entry
http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_SanDisk_USB-Stick.pdfBroken Link
http://www.syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9
http://www.vupen.com/english/advisories/2010/0078Third Party Advisory
https://www.ironkey.com/usb-flash-drive-flaw-exposedBroken Link

Timeline

Published: Jan 7, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-02264.6SanDisk Cruzer Enterprise USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the CVE-2010-02274.6Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives validate passwords with a program running on the host computer CVE-2010-02284.6Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives use a fixed 256-bit key for obtaining access to the cleartext d CVE-2010-02294.6Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives do not prevent password replay attacks, which allows physically CVE-2010-02307.5SUSE Linux Enterprise 10 SP3 (SLE10-SP3) and openSUSE 11.2 configures postfix to listen on all network interfaces, which might allow remote CVE-2010-023110.0The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista G CVE-2010-02327.8The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windo CVE-2010-02337.2Double free vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server CVE-2010-02344.7The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 does not p CVE-2010-02354.7The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Vista Gold does not perform the expected validation before cr CVE-2010-02367.2The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Vista Gold does not properly allocate memory for the destinat CVE-2010-02376.9The kernel in Microsoft Windows 2000 SP4 and XP SP2 and SP3 allows local users to gain privileges by creating a symbolic link from an untrus