-----------------------------------------------------------------------
[ iViZ Security Advisory 08-010                            17/09/2008 ]
-----------------------------------------------------------------------
iViZ Techno Solutions Pvt. Ltd.
                                            http://www.ivizsecurity.com
-----------------------------------------------------------------------

* Title:     McAfee SafeBoot Device Encryption
             Plain Text Password Disclosure
* Date:      17/09/2008
* Software:  McAfee SafeBoot Device Encryption v4, Build 4750 and below

--[ Synopsis:

    The password checking routine of SafeBoot Device Encryption fails to
    sanitize the BIOS keyboard buffer after reading passwords, resulting
    in plain text password leakage to unprivileged local users.

--[ Affected Software:

  * SafeBoot Device Encryption v4, Build 4750 and below

--[ Non Affected Software:

  * SafeBoot Device Encryption v4, Build 4760 and above
  * SafeBoot Device Encryption v5.x

--[ Technical description:

    SafeBoot's pre-boot authentication routines use the BIOS API to
    read user input via the keyboard. The BIOS internally copies the
    keystrokes in a RAM structure called the BIOS Keyboard buffer
    inside the BIOS Data Area. This buffer is not flushed after use,
    resulting in potential plain text password leakage once the OS
    is fully booted, assuming the attacker can read the password at
    physical memory location 0x40:0x1e.


--[ Impact:

    Plain text password disclosure. Local guest access is required,
    but no physical access to the machine.

--[ Full Technical Whitepaper

    http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf

--[ Vendor response:

    Vendor quoted:

    "SafeBoot Device Encryption v4, Build 4750 and below are subject to this
    vulnerability. Builds 4760 and above are not. Customers should upgrade
    to the current version of SafeBoot Device Encryption v4, or migrate to
    the current McAfee Endpoint Encryption for PC v5 platform which replaced
    the earlier product in March 2007."


--[ Credits:

    This vulnerability was discovered by Security Researcher
    Jonathan Brossard from iViZ Techno Solutions Pvt. Ltd.

    Jonathan would like to thank the people present at his
    Defcon presentation who sent him informations regarding
    the vulnerability affecting this particular product.

--[ Disclosure timeline:

  * First private disclosure to vendor on August 19th 2008
  * McAfee asked for more technical details on August 20th 2008
  * First Public disclosure on September 17th 2008

--[ Reference:

    http://www.ivizsecurity.com/security-advisory.html