CVE-2008-3898

LOW 2.1CVE-2008-3898 · Published 03/09/2008 · updated 16/06/2026

In short

CVE-2008-3898 is a LOW (CVSS 2.1) vulnerability affecting drivecrypt plus pack (secustar).
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 28.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
drivecrypt plus pack secustar	`= 3.9`	No fix yet

Description

Secu Star DriveCrypt Plus Pack 3.9 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

References

secunia.com/advisories/31605 · Vendor Advisory
securityreason.com/securityalert/4213
ivizsecurity.com/preboot-patch.html
ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
ivizsecurity.com/security-advisory-iviz-sr-0807.html
securityfocus.com/archive/1/495803/100/0/threaded
securityfocus.com/bid/30818

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free