Medium severity · published Sep 3, 2008
CVE-2008-3893
Microsoft Bitlocker in Windows Vista before SP1 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer during boot, which allows local…
5.5
CVSS
1.5%
EPSS
No
On KEV
Description
Microsoft Bitlocker in Windows Vista before SP1 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer during boot, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WV
Windows Vista · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3893
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3893
Vendor Advisory
http://secunia.com/advisories/31619
www.ivizsecurity.com
http://www.ivizsecurity.com/security-advisory-iviz-sr-0801.html
More from Windows Vista
9.8
CVE-2008-4250
Microsoft Windows Buffer Overflow Vulnerability
8.8
CVE-2016-7256
Microsoft Windows Open Type Font Remote Code Execution Vulnerability
8.8
CVE-2015-2426
Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability
8.8
CVE-2015-2360
Microsoft Win32k Privilege Escalation Vulnerability
8.8
CVE-2014-6332
Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability