CVE-2005-4176 - AWARD Bios Modular 4.50pg does not clear the keyboard buffer after reading the BIOS password during

CVE-2005-4176

Summary

AWARD Bios Modular 4.50pg does not clear the keyboard buffer after reading the BIOS password during system startup, which allows local administrators or users to read the password directly from physical memory.

References

http://www.ivizsecurity.com/preboot-patch.html
http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
http://www.kb.cert.org/vuls/id/847537
http://www.pulltheplug.org/users/endrazine/Bios.Information.Leakage.txt
http://www.securityfocus.com/archive/1/419610/100/0/threaded
http://www.securityfocus.com/bid/15751

Vulnerable Configurations

cpe:2.3:h:award:award_bios_modular:4.50pg:*:*:*:*:*:*:*
cpe:2.3:h:award:award_bios_modular:4.50pg:*:*:*:*:*:*:*

CVSS

Base:	2.1 (as of 19-10-2018 - 15:40)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:L/AC:L/Au:N/C:P/I:N/A:N

refmap via4

bid	15751
bugtraq	20051213 Bios Information Leakage
cert-vn	VU#847537
misc	http://www.ivizsecurity.com/preboot-patch.html http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf http://www.pulltheplug.org/users/endrazine/Bios.Information.Leakage.txt

Last major update

19-10-2018 - 15:40

Published

11-12-2005 - 21:03

Last modified

19-10-2018 - 15:40