CVE-2005-4176

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Multiple Vendor BIOS - Keyboard Buffer Password Persistence (2)2005-12-06 · local · unix · Verified
• Multiple Vendor BIOS - Keyboard Buffer Password Persistence (1)2005-12-06 · local · windows · Verified

Impact

AWARD Bios Modular 4.50pg does not clear the keyboard buffer after reading the BIOS password during system startup, which allows local administrators or users to read the password directly from physical memory.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

References

• NVD record
• CVE.org record
• http://www.ivizsecurity.com/preboot-patch.html
• http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
• http://www.kb.cert.org/vuls/id/847537
• http://www.pulltheplug.org/users/endrazine/Bios.Information.Leakage.txt
• http://www.securityfocus.com/archive/1/419610/100/0/threaded
• http://www.securityfocus.com/bid/15751
• http://www.ivizsecurity.com/preboot-patch.html
• http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
• http://www.kb.cert.org/vuls/id/847537
• http://www.pulltheplug.org/users/endrazine/Bios.Information.Leakage.txt
• http://www.securityfocus.com/archive/1/419610/100/0/threaded
• http://www.securityfocus.com/bid/15751