PT-2008-5233 · Truecrypt · Truecrypt

Jonathan Brossard · Publicado 2008-09-03 · Atualizado 2018-10-11 · CVE-2008-3899

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TrueCrypt version 5.0

Description The issue allows local users to obtain sensitive information by reading physical memory locations. This is due to the storage of pre-boot authentication passwords in the BIOS Keyboard buffer without properly clearing the buffer before and after use.

Recommendations For TrueCrypt version 5.0, consider disabling the pre-boot authentication feature until a proper fix is implemented to clear the BIOS Keyboard buffer after use.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-3899

Produtos afetados

Truecrypt

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-3899 · Nota de Segurança
• http://securityreason.com/securityalert/4203 · Nota
• http://securityfocus.com/archive/1/495805/100/0/threaded · Nota
• http://ivizsecurity.com/research/preboot/preboot_whitepaper.pdf · Nota
• http://ivizsecurity.com/preboot-patch.html · Nota