[NT] Kaspersky Labs Anti-Virus IOCTL Local Privilege Escalation

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Kaspersky Labs Anti-Virus IOCTL Local Privilege Escalation
------------------------------------------------------------------------


SUMMARY

<http://www.kaspersky.com/> Kaspersky Anti-Virus provides virus and
spyware protection.

Local exploitation of a design error vulnerability in Kaspersky Labs
Anti-Virus allows an attacker to execute arbitrary code with kernel
privileges.

DETAILS

Vulnerable Systems:
* Kaspersky Labs Anti-Virus version 6.0.0.303 with KLICK and KLIN device
drivers version 2.0.0.281.

The vulnerability specifically exists due to improper address space
validation when the KLIN and KLICK device drivers processes IOCTL
0x80052110. By passing a specially crafted Irp structure to the affected
IOCTL handler, attackers can cause the driver to execute arbitrary code
via a CALL instruction using user supplied data. Execution of data stored
in user-land buffers is trivial.

Exploitation allows attackers to gain elevated privileges by executing
code within kernel context. This allows attackers to gain control of the
affected system. However, local access is required for exploitation to be
successful.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4926>
CVE-2006-4926.

Disclosure Timeline:
* 09/18/2006 - Initial vendor notification
* 09/19/2006 - Initial vendor response
* 10/19/2006 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by iDefense.
The original article can be found at:

<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=425>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=425



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Microsoft License Manager and urlmon.dll COM Object Interaction Invalid Memory Access Vulnerabi
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Internet Explorer is "a set of core technologies in Microsoft Windows ... exploitation of an invalid memory access vulnerability in various ... COM objects may allow an attacker to execute arbitrary code. ...
    (Securiteam)
  • [NT] Ipswitch WhatsUp Gold Remote Buffer Overflow Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Ipswitch WhatsUp Gold is "a Microsoft Windows based network monitoring ... WhatsUp Gold allows attackers to execute arbitrary code under the ... for the value of 'instancename', a buffer overflow occurs allowing an ...
    (Securiteam)
  • [UNIX] Double Choco Latte Remote Code Execution
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Double Choco Latte to execute arbitrary code. ... The following URL will execute the PHP command 'system' with the command ...
    (Securiteam)
  • [UNIX] Gaim Festival Example Plugin Command Execution Vulnerability (Exploit)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability exists in any plugin that has copied its code from the ... example plugin to execute arbitrary code. ...
    (Securiteam)
  • [UNIX] SNMPPd Format String Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A format string vulnerability has been discovered in SNMP Proxy daemon, ... allowing a remote attacker to cause the program to execute arbitrary code. ...
    (Securiteam)