PT-2008-5233 · Truecrypt · Truecrypt

Jonathan Brossard · Published 2008-09-03 · Updated 2018-10-11 · CVE-2008-3899

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TrueCrypt version 5.0

Description The issue allows local users to obtain sensitive information by reading physical memory locations. This is due to the storage of pre-boot authentication passwords in the BIOS Keyboard buffer without properly clearing the buffer before and after use.

Recommendations For TrueCrypt version 5.0, consider disabling the pre-boot authentication feature until a proper fix is implemented to clear the BIOS Keyboard buffer after use.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-3899

Affected Products

Truecrypt

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-3899 · Security Note
• http://securityreason.com/securityalert/4203 · Note
• http://securityfocus.com/archive/1/495805/100/0/threaded · Note
• http://ivizsecurity.com/research/preboot/preboot_whitepaper.pdf · Note
• http://ivizsecurity.com/preboot-patch.html · Note