PT-2008-5231 · None · Diskcryptor

Publicado 2008-09-03 · Atualizado 2018-10-11 · CVE-2008-3897

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DiskCryptor version 0.2.6

Description The issue allows local users to obtain sensitive information, specifically pre-boot authentication passwords, by reading physical memory locations associated with the BIOS Keyboard buffer. This is because the passwords are stored in this buffer and not cleared before and after use.

Recommendations For DiskCryptor version 0.2.6, consider clearing the BIOS Keyboard buffer after use to prevent sensitive information from being obtained. As a temporary workaround, restrict physical access to the system to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-3897

Produtos afetados

Diskcryptor

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-3897 · Nota de Segurança
• http://securityreason.com/securityalert/4212 · Nota
• http://securityfocus.com/archive/1/495725/100/0/threaded · Nota
• http://ivizsecurity.com/research/preboot/preboot_whitepaper.pdf · Nota
• http://ivizsecurity.com/preboot-patch.html · Nota