Multiple Vendor BIOS Keyboard Buffer Password Persistence Weakness

Bugtraq ID:	15751
Class:	Design Error
CVE:	CVE-2005-4175 CVE-2005-4176 CVE-2008-7020 CVE-2008-3898
Remote:	No
Local:	Yes
Published:	Dec 06 2005 12:00AM
Updated:	May 12 2015 07:48PM
Credit:	Endrazine <[email protected]> disclosed this issue.
Vulnerable:	TrueCrypt TrueCrypt 5.0 SecurStar DriveCrypt Plus Pack 3.9 McAfee SafeBoot Device Encryption 4 Build 4750 Intel BIOS TW96510J.86A.1157 Intel BIOS PE94510M.0050.20.86A Intel BIOS JOQ3510J.86A.0942 Intel BIOS DPP3510J.86A.0484 Intel BIOS BTX3810J.86A.1814 Insyde Insyde BIOS V190 IBM BIOS 7CETB5WW 2.05 HP BIOS 68DTT F.0D GNU GRUB 0.97 AWARD AWARD BIOS Modular 4.50 pg
Not Vulnerable:	McAfee SafeBoot Device Encryption 5 McAfee SafeBoot Device Encryption 4 Build 4760

Multiple Vendor BIOS Keyboard Buffer Password Persistence Weakness

Multiple vendors fail to clear the BIOS (Basic Input-Output System) keyboard buffer after reading the preboot authentication password during the system startup process.

Depending on the operating system running on affected computers, the memory region may or may not be available for user-level access. With Linux operating systems, superuser access is required. With Microsoft Windows operating systems, nonprivileged users may access the keyboard buffer region.

Attackers who obtain the password used for preboot authentication may then use it for further attacks.

UPDATE: Reportedly, the BIOS API calls and the BIOS keyboard buffer are used by various preboot authentication applications to read a password from the keyboard in an insecure manner. These applications are also vulnerable to this issue.

This issue is reported to affect the following software:

- Truecrypt 5.0 for Windows
- DiskCryptor 0.2.6 for Windows and prior
- Secu Star DriveCrypt Plus Pack v3.9 and prior
- Grub Legacy (GNU GRUB 0.97) and prior
- Lilo 22.6.1 and prior versions
- Award BIOS Modular 4.50pg
- Insyde BIOS V190
- Intel Corp BIOS PE94510M.86A.0050.2007.0710.1559 (07/10/2007)
- Hewlett-Packard BIOS 68DTT Ver. F.0D (11/22/2005)
- IBM Lenovo BIOS 7CETB5WW v2.05 (10/13/2006)

Multiple Vendor BIOS Keyboard Buffer Password Persistence Weakness

The following exploits are available:

• /data/vulnerabilities/exploits/15751_shellcode.s
• /data/vulnerabilities/exploits/15751_Sploit-OS.S
• /data/vulnerabilities/exploits/15751_generic.unix.sploit.c

Multiple Vendor BIOS Keyboard Buffer Password Persistence Weakness

Solution:
Reportedly, fixes from multiple vendors are available, but Symantec did not confirm this information.

Intel has released fixes; please see the references for more information.

Multiple Vendor BIOS Keyboard Buffer Password Persistence Weakness

References:

• McAfee Endpoint Encryption (formerly SafeBoot Encryption) (McAfee)
  
• BIOS Information Leakage (Endrazine)
  
• Bypassing pre-boot authenti ation passwords by instrumenting the BIOS keyboard b (iViZ Techno Solutions Pvt)
  
• IBM Lenovo BIOS Plain Text Password Disclosure (iViZ Techno Solutions Pvt)
  
• INTEL-SA-00016 - Intel Keyboard Buffer Information Disclosure Vulnerability (Intel)
  
• Microsoft Bitlocker Plain Text Password Disclosure (iViZ Techno Solutions Pvt)
  
• Security Advisory: DiskCryptor Security Model bypass exploiting wrong BIOS API u (iViZ Techno Solutions Pvt)
  
• Security Advisory: DriveCrypt Security Model bypass exploiting wrong BIOS API us (iViZ Techno Solutions Pvt)
  
• Security Advisory: Grub Legacy Security Model bypass exploiting wrong BIOS API u (iViZ Techno Solutions Pvt)
  
• Security Advisory: Hewlett-Packard BIOS Plain Text Password Disclosure (iViZ Techno Solutions Pvt)
  
• Security Advisory: Intel BIOS Plain Text Password Disclosure (iViZ Techno Solutions Pvt)
  
• Security Advisory: LILO Security Model bypass exploiting wrong BIOS API usage (iViZ Techno Solutions Pvt)
  
• Security Advisory: McAfee SafeBoot Device Encryption v4, Build 4750 and below (iViZ Techno Solutions Pvt)
  
• Security Advisory: TrueCrypt Security Model bypass exploiting wrong BIOS API usa (iViZ Techno Solutions Pvt)