PT-2008-5234 · Intel · Intel Firmware

Jonathan Brossard · Publicado 2008-09-03 · Atualizado 2018-10-11 · CVE-2008-3900

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Intel firmware version 0050.2007.0710.1559

Description The issue allows local users to obtain sensitive information, specifically pre-boot authentication passwords, by reading physical memory locations associated with the BIOS Keyboard buffer. This is possible because the passwords are stored in the buffer and not cleared after use.

Recommendations For Intel firmware version 0050.2007.0710.1559, consider disabling the pre-boot authentication feature until a patch is available to clear the BIOS Keyboard buffer after use. Restrict physical access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-3900

Produtos afetados

Intel Firmware

Referências · 7

• http://securitytracker.com/id?1020738 · Nota
• http://securityreason.com/securityalert/4205 · Nota
• http://kb.cert.org/vuls/id/604539 · Nota
• http://ivizsecurity.com/research/preboot/preboot_whitepaper.pdf · Nota
• http://securityfocus.com/archive/1/495804/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3900 · Nota de Segurança
• http://ivizsecurity.com/preboot-patch.html · Nota