Vulnerability Description
Buffer overflow in Dell BIOS on Dell Latitude D###, E####, XT2, and Z600 devices, and Dell Precision M#### devices, allows local users to bypass intended BIOS signing requirements and install arbitrary BIOS images by leveraging administrative privileges and providing a crafted rbu_packet.pktNum value in conjunction with a crafted rbu_packet.pktSize value.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dell | Latitude D530 | - |
| Dell | Latitude D531 | - |
| Dell | Latitude D630 | - |
| Dell | Latitude D631 | - |
| Dell | Latitude D830 | - |
| Dell | Latitude E4200 | - |
| Dell | Latitude E4300 | - |
| Dell | Latitude E5400 | - |
| Dell | Latitude E5500 | - |
| Dell | Latitude E6400 | - |
| Dell | Latitude E6400 Atg | - |
| Dell | Latitude E6400 Atg Xfr | - |
| Dell | Latitude E6500 | - |
| Dell | Latitude Xt2 | - |
| Dell | Latitude Z600 | - |
| Dell | Precision M2300 | - |
| Dell | Precision M2400 | - |
| Dell | Precision M4300 | - |
| Dell | Precision M4400 | - |
| Dell | Precision M6300 | - |
Related Weaknesses (CWE)
References
- http://www.kb.cert.org/vuls/id/912156US Government Resource
- http://www.kb.cert.org/vuls/id/BLUU-99HSLAUS Government Resource
- https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-Slides.pdfExploit
- https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-WP.pdfExploit
- https://www.blackhat.com/us-13/archives.html#Butterworth
- http://www.kb.cert.org/vuls/id/912156US Government Resource
- http://www.kb.cert.org/vuls/id/BLUU-99HSLAUS Government Resource
- https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-Slides.pdfExploit
- https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-WP.pdfExploit
- https://www.blackhat.com/us-13/archives.html#Butterworth
FAQ
What is CVE-2013-3582?
CVE-2013-3582 is a vulnerability with a CVSS score of 7.6 (HIGH). Buffer overflow in Dell BIOS on Dell Latitude D###, E####, XT2, and Z600 devices, and Dell Precision M#### devices, allows local users to bypass intended BIOS signing requirements and install arbitrar...
How severe is CVE-2013-3582?
CVE-2013-3582 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-3582?
Check the references section above for vendor advisories and patch information. Affected products include: Dell Latitude D530, Dell Latitude D531, Dell Latitude D630, Dell Latitude D631, Dell Latitude D830.