Multiple Product SMM Local Code Execution Vulnerabilities

System Management Mode SMM is the highest privilege execution mode on x86 processors. Multiple BIOS implementations allow the SMM function to call memory locations other than SMRAM. An attacker with access to physical memory first corrupts the function pointer or function called by SMM, then writ...

BIOS implementations permit unsafe SMM function calls to memory locations outside of SMRAM

Overview Multiple BIOS implementations permit unsafe System Management Mode SMM function calls to memory locations outside of SMRAM. Description Multiple BIOS implementations permit unsafe System Management Mode SMM function calls to memory locations outside of SMRAM. According to Corey Kallenber...

BIOS Rootkit Implant Debuts at CanSecWest

When the National Security Agency’s ANT division catalog of surveillance tools was disclosed among the myriad of Snowden revelations, its desire to implant malware into the BIOS of targeted machines was unquestionable. While there’s little evidence of BIOS bootkits in the wild, the ANT catalog an...

Intel UEFI EFI S3 Resume Boot Path Script Privilege Escalation (INTEL-SA-00041)

The version of the Intel UEFI BIOS on the remote host is affected by a privilege escalation vulnerability due to an error, related to handling the EFI S3 Resume Boot Path boot script, that allows bypassing firmware write protections. An attacker can exploit this to perform a reflash of the...

Intel Chipsets Local Competition Condition Security Bypass Vulnerability

Intel is the world's largest manufacturer of personal computer parts and CPUs. A competitive condition vulnerability exists in Intel chipsets that rely solely on the BIOSCNTL.BIOSWE and BIOSCNTL.BLE bits as the BIOS write lockout mechanism, allowing a local attacker to exploit the vulnerability t...

BIOS Security Updates for Multiple Issues

Summary: New BIOS updates are available for Intel products. These updates harden the implementation against malicious inputs at various stages of the boot process and runtime. Description: This update addresses issues identified in the process of resuming from a sleep state, processing data store...

DHS Warns of UEFI Hardware Vulnerabilities

The CERT/CC at Carnegie Mellon University today released three advisories warning of vulnerabilities that affect some unified extensible firmware interface UEFI systems and the BIOS of some Intel chipsets. Hardware and firmware vulnerabilities, such as these reported by Corey Kallenberg of MITRE...

Intel BIOS locking mechanism contains race condition that enables write protection bypass

Overview A race condition exists in Intel chipsets that rely solely on the BIOSCNTL.BIOSWE and BIOSCNTL.BLE bits as a BIOS write locking mechanism. Successful exploitation of this vulnerability may result in a bypass of this locking mechanism. Description CWE-362: Concurrent Execution using Share...

[SECURITY] Fedora 19 Update: grub2-2.00-27.fc19

The GRand Unified Bootloader GRUB is a highly configurable and customizab le bootloader with modular architecture. It support rich varietyof kernel for mats, file systems, computer architectures and hardware devices. This subpackage provides support for PC BIOS systems...

[SECURITY] Fedora 20 Update: grub2-2.00-27.fc20

The GRand Unified Bootloader GRUB is a highly configurable and customizab le bootloader with modular architecture. It support rich varietyof kernel for mats, file systems, computer architectures and hardware devices. This subpackage provides support for PC BIOS systems...

[SECURITY] Fedora 21 Update: grub2-2.02-0.13.fc21

The GRand Unified Bootloader GRUB is a highly configurable and customizab le bootloader with modular architecture. It support rich varietyof kernel for mats, file systems, computer architectures and hardware devices. This subpackage provides support for PC BIOS systems...

New BlackEnergy Crimeware Enhanced to Target Linux Systems and Cisco Routers

Security researchers at Kaspersky Lab have unearthed new capabilities in the BlackEnergy Crimeware weapon that has now ability to hacking routers, Linux systems and Windows, targeting industry through Cisco network devices. The antivirus vendor’s Global Research & Analysis Team released a report...

dos_ssh - Use BIOS ram hacks to make a SSH server

Use BIOS ram hacks to make a SSH server out of any INT 10 13h app MS-DOS is one of those You can find a demo Youtube Video here below: Download dosssh...

Millions of PCs Affected by Mysterious Computrace Backdoor

UPDATE: A previous version of this story incorrectly stated that Anibal Sacco works for Core Security. Sacco left Core Security last year to start Cubica Labs. LAS VEGAS – Nearly every PC has an anti-theft product called Computrace embedded in its BIOS PCI Optional ROM or its unified extensible...

[security bulletin] HPSBHF03084 rev.1 HP PCs with UEFI Firmware, Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04393276 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04393276 Version: 1 HPSBHF03084 rev....

UEFI EDK2 Capsule Update vulnerabilities

Overview The EDK2 UEFI reference implementation contains multiple vulnerabilities in the Capsule Update mechanism. Description The open source EDK2 project provides a reference implementation of the Unified Extensible Firmware Interface UEFI. Researchers at The MITRE Corporation have discovered...

samba: remote code execution in nmbd

A heap-based buffer overflow flaw was found in Samba's NetBIOS message block daemon nmbd. An attacker on the local network could use this flaw to send specially crafted packets that, when processed by nmbd, could possibly lead to arbitrary code execution with root privileges...

Multiple Vendor BIOS Keyboard Buffer Password Persistence Weakness (1)

No description provided by source. source: http://www.securityfocus.com/bid/15751/info Multiple vendors fail to clear the BIOS Basic Input-Output System keyboard buffer after reading the preboot authentication password during the system startup process. Depending on the operating system running o...

Windows NT - User Mode to Ring 0 Escalation Vulnerability

No description provided by source. Microsoft Windows NT GP Trap Handler Allows Users to Switch Kernel Stack ------------------------------------------------------------------------- CVE-2010-0232 In order to support BIOS service routines in legacy 16bit applications, the Windows NT Kernel support...

Dell IT Assistant detectIESettingsForITA.ocx ActiveX Control

No description provided by source. !-- Dell IT Assistant detectIESettingsForITA.ocx ActiveX Control readRegVal Remote Registry Dump Vulnerability download uri: ftp://ftp.us.dell.com/sysman/OM-ITAssistant-Dell-Web-WIN-6.5.0-2247A01.21.exe ActiveX settings: CLSID: 6286EF1A-B56E-48EF-90C3-743410657F...