{"id":"CVE-2004-1038","aliases":["EUVD-2004-1036","GHSA-3hpw-p9mr-gxg9"],"status":"published","title":"A design error in the IEEE1394 specification allows attackers with physical access to a device to...","description":"A design error in the IEEE1394 specification allows attackers with physical access to a device to read and write to sensitive memory using a modified FireWire/IEEE 1394 client, thus bypassing intended restrictions that would normally require greater degrees of physical access to exploit.  NOTE: this was reported in 2008 to affect Windows Vista, but some Linux-based operating systems have protection mechanisms against this attack.","severity":{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00483,"percentile":0.41862,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2004-11-16T05:00:00Z","modified":"2026-06-16T22:06:54Z","products":[{"vendor":"ieee","product":"firewire_ieee"}],"references":[{"url":"http://pacsec.jp/advisories.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489330/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489189/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489163/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://it.slashdot.org/article.pl?sid=08/03/04/1258210","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=109881362530790\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489295/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/18041","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://md.hudora.de/presentations/firewire/2005-firewire-cansecwest.pdf","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489296/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489269/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489322/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.sec-consult.com/fileadmin/Whitepapers/Vista_Physical_Attacks.pdf","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489212/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489175/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489257/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489342/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://storm.net.nz/static/files/ab_firewire_rux2k6-final.pdf","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://storm.net.nz/projects/16","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.theage.com.au/news/security/hack-into-a-windows-pc-no-password-needed/2008/03/04/1204402423638.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/489335/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-1038"},{"url":"https://github.com/advisories/GHSA-3hpw-p9mr-gxg9"}],"sources":{"cve":[{"id":"CVE-2004-1038","description":"A design error in the IEEE1394 specification allows attackers with physical access to a device to read and write to sensitive memory using a modified FireWire/IEEE 1394 client, thus bypassing intended restrictions that would normally require greater degrees of physical access to exploit.  NOTE: this was reported in 2008 to affect Windows Vista, but some Linux-based operating systems have protection mechanisms against this attack.","status":"published","published":"2004-11-16T05:00:00Z","modified":"2024-08-08T00:38:59.834Z","updated_at":"2026-11-02T14:34:54.398187Z"}],"euvd":[{"id":"EUVD-2004-1036","description":"A design error in the IEEE1394 specification allows attackers with physical access to a device to read and write to sensitive memory using a modified FireWire/IEEE 1394 client, thus bypassing intended restrictions that would normally require greater degrees of physical access to exploit.  NOTE: this was reported in 2008 to affect Windows Vista, but some Linux-based operating systems have protection mechanisms against this attack.","status":"published","published":"2004-11-16T05:00:00Z","modified":"2024-08-08T00:38:59Z","updated_at":"2026-11-03T01:15:16.711153Z"}],"ghsa":[{"id":"GHSA-3hpw-p9mr-gxg9","title":"A design error in the IEEE1394 specification allows attackers with physical access to a device to...","description":"A design error in the IEEE1394 specification allows attackers with physical access to a device to read and write to sensitive memory using a modified FireWire/IEEE 1394 client, thus bypassing intended restrictions that would normally require greater degrees of physical access to exploit.  NOTE: this was reported in 2008 to affect Windows Vista, but some Linux-based operating systems have protection mechanisms against this attack.","status":"published","published":"2022-04-29T02:58:50Z","modified":"2023-01-30T05:03:17Z","updated_at":"2026-11-02T14:46:48.522337Z"}],"nvd":[{"id":"CVE-2004-1038","description":"A design error in the IEEE1394 specification allows attackers with physical access to a device to read and write to sensitive memory using a modified FireWire/IEEE 1394 client, thus bypassing intended restrictions that would normally require greater degrees of physical access to exploit.  NOTE: this was reported in 2008 to affect Windows Vista, but some Linux-based operating systems have protection mechanisms against this attack.","status":"published","published":"2005-03-01T05:00:00Z","modified":"2026-06-16T22:06:54.13Z","cvss":[{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:00:53.662124Z"}]}}