.svg?width=185&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=13&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
Low
Intercept X for Mobile (Android) Resolves Insecure Data Storage Vulnerability (CVE-2021-25266)
CVE(N)
CVE-2021-25266
PRODOTTO(I)
Sophos Authenticator
Sophos Mobile
Aggiornato
2022 Apr 27
Versione articolo
1
Pubblicato
2022 Apr 27
ID pubblicazione
sophos-sa-20220427-ixm-storage
Soluzione alternativa
No
Overview
An insecure data storage vulnerability, allowing a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones, in Sophos Authenticator for Android and Intercept X for Mobile (Android) was discovered and responsibly disclosed to Sophos by an external security researcher. The vulnerability has been fixed in Intercept X for Mobile (Android). There is no action required for Intercept X for Mobile customers, as updates are installed automatically by default.
Sophos would like to thank Can Özkan for responsibly disclosing the issue to Sophos.
Applies to the following Sophos product(s) and version(s)
Sophos Authenticator (Android)
Intercept X for Mobile (Android) before version 9.7.3495
Remediation
Fix included in Intercept X for Mobile (Android) version 9.7.3495 on March 16, 2022
Users of Sophos Authenticator (Android) are required to migrate to Intercept X for Mobile (Android) to receive this fix
Related information
Sophos Responsible Disclosure Policy
To learn about Sophos security vulnerability disclosure policies and publications, see the Responsible Disclosure Policy.