PT-2008-5234 · Intel · Intel Firmware

Jonathan Brossard · Published 2008-09-03 · Updated 2018-10-11 · CVE-2008-3900

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Intel firmware version 0050.2007.0710.1559

Description The issue allows local users to obtain sensitive information, specifically pre-boot authentication passwords, by reading physical memory locations associated with the BIOS Keyboard buffer. This is possible because the passwords are stored in the buffer and not cleared after use.

Recommendations For Intel firmware version 0050.2007.0710.1559, consider disabling the pre-boot authentication feature until a patch is available to clear the BIOS Keyboard buffer after use. Restrict physical access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-3900

Affected Products

Intel Firmware

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-3900 · Security Note
• http://securitytracker.com/id?1020738 · Note
• http://securityreason.com/securityalert/4205 · Note
• http://kb.cert.org/vuls/id/604539 · Note
• http://ivizsecurity.com/research/preboot/preboot_whitepaper.pdf · Note
• http://securityfocus.com/archive/1/495804/100/0/threaded · Note
• http://ivizsecurity.com/preboot-patch.html · Note