{"api_version":"1","generated_at":"2026-04-23T04:33:29+00:00","cve":"CVE-2003-1309","urls":{"html":"https://cve.report/CVE-2003-1309","api":"https://cve.report/api/cve/CVE-2003-1309.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2003-1309","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2003-1309"},"summary":{"title":"CVE-2003-1309","description":"The DeviceIoControl function in the TrueVector Device Driver (VSDATANT) in ZoneAlarm before 3.7.211, Pro before 4.0.146.029, and Plus before 4.0.146.029 allows local users to gain privileges via certain signals (aka \"Device Driver Attack\").","state":"PUBLISHED","assigner":"mitre","published_at":"2003-12-31 05:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"10","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.osvdb.org/4362","name":"http://www.osvdb.org/4362","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/8342","name":"http://www.securityfocus.com/bid/8342","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"ZoneAlarm Local Device Driver IO Control Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/9459","name":"http://secunia.com/advisories/9459","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Secunia - Advisories - ZoneAlarm TrueVector Device Driver Privilege Escalation","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://sec-labs.hack.pl/advisories/seclabs-adv-zone-alarm-04-08-2003.txt","name":"http://sec-labs.hack.pl/advisories/seclabs-adv-zone-alarm-04-08-2003.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Strona nie znaleziona - hack.pl","mime":"text/plain","httpstatus":"404","archivestatus":"200"},{"url":"http://sec-labs.hack.pl/papers/win32ddc.php","name":"http://sec-labs.hack.pl/papers/win32ddc.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[sec-labs] Win32 Device Communication Vulnerabilities","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0070.html","name":"http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0070.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"Neohapsis Archives - VulnWatch - #0070 - [VulnWatch] Local ZoneAlarm Firewall (probably all versions - tested on v3.1)","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.osvdb.org/2375","name":"http://www.osvdb.org/2375","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/12824","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/12824","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://download.zonelabs.com/bin/free/information/znalm/zaReleaseHistory.html","name":"http://download.zonelabs.com/bin/free/information/znalm/zaReleaseHistory.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Zone Labs: ZoneAlarm Release History","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2003-1309","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2003-1309","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2003","cve_id":"1309","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zonelabs","cpe5":"zonealarm","cpe6":"3.7.202","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2003","cve_id":"1309","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zonelabs","cpe5":"zonealarm","cpe6":"3.7.211","cpe7":"*","cpe8":"plus","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2003","cve_id":"1309","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zonelabs","cpe5":"zonealarm","cpe6":"3.7.211","cpe7":"*","cpe8":"pro","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T02:19:46.130Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"4362","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/4362"},{"name":"8342","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/8342"},{"name":"device-driver-gain-privileges(12824)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/12824"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://download.zonelabs.com/bin/free/information/znalm/zaReleaseHistory.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://sec-labs.hack.pl/papers/win32ddc.php"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://sec-labs.hack.pl/advisories/seclabs-adv-zone-alarm-04-08-2003.txt"},{"name":"2375","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/2375"},{"name":"9459","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/9459"},{"name":"20030805 Local ZoneAlarm Firewall (probably all versions - tested on v3.1)","tags":["mailing-list","x_refsource_VULNWATCH","x_transferred"],"url":"http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0070.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2003-08-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"The DeviceIoControl function in the TrueVector Device Driver (VSDATANT) in ZoneAlarm before 3.7.211, Pro before 4.0.146.029, and Plus before 4.0.146.029 allows local users to gain privileges via certain signals (aka \"Device Driver Attack\")."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"4362","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/4362"},{"name":"8342","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/8342"},{"name":"device-driver-gain-privileges(12824)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/12824"},{"tags":["x_refsource_CONFIRM"],"url":"http://download.zonelabs.com/bin/free/information/znalm/zaReleaseHistory.html"},{"tags":["x_refsource_MISC"],"url":"http://sec-labs.hack.pl/papers/win32ddc.php"},{"tags":["x_refsource_MISC"],"url":"http://sec-labs.hack.pl/advisories/seclabs-adv-zone-alarm-04-08-2003.txt"},{"name":"2375","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/2375"},{"name":"9459","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/9459"},{"name":"20030805 Local ZoneAlarm Firewall (probably all versions - tested on v3.1)","tags":["mailing-list","x_refsource_VULNWATCH"],"url":"http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0070.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2003-1309","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The DeviceIoControl function in the TrueVector Device Driver (VSDATANT) in ZoneAlarm before 3.7.211, Pro before 4.0.146.029, and Plus before 4.0.146.029 allows local users to gain privileges via certain signals (aka \"Device Driver Attack\")."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"4362","refsource":"OSVDB","url":"http://www.osvdb.org/4362"},{"name":"8342","refsource":"BID","url":"http://www.securityfocus.com/bid/8342"},{"name":"device-driver-gain-privileges(12824)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/12824"},{"name":"http://download.zonelabs.com/bin/free/information/znalm/zaReleaseHistory.html","refsource":"CONFIRM","url":"http://download.zonelabs.com/bin/free/information/znalm/zaReleaseHistory.html"},{"name":"http://sec-labs.hack.pl/papers/win32ddc.php","refsource":"MISC","url":"http://sec-labs.hack.pl/papers/win32ddc.php"},{"name":"http://sec-labs.hack.pl/advisories/seclabs-adv-zone-alarm-04-08-2003.txt","refsource":"MISC","url":"http://sec-labs.hack.pl/advisories/seclabs-adv-zone-alarm-04-08-2003.txt"},{"name":"2375","refsource":"OSVDB","url":"http://www.osvdb.org/2375"},{"name":"9459","refsource":"SECUNIA","url":"http://secunia.com/advisories/9459"},{"name":"20030805 Local ZoneAlarm Firewall (probably all versions - tested on v3.1)","refsource":"VULNWATCH","url":"http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0070.html"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2003-1309","datePublished":"2006-11-30T16:00:00.000Z","dateReserved":"2006-11-30T00:00:00.000Z","dateUpdated":"2024-08-08T02:19:46.130Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2003-12-31 05:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zonelabs:zonealarm:3.7.202:*:*:*:*:*:*:*","matchCriteriaId":"266266D9-0705-4B10-BD0C-18993431C93E"},{"vulnerable":true,"criteria":"cpe:2.3:a:zonelabs:zonealarm:3.7.211:*:plus:*:*:*:*:*","matchCriteriaId":"34C1FA2F-F6F4-49AC-B309-DE38F62D660A"},{"vulnerable":true,"criteria":"cpe:2.3:a:zonelabs:zonealarm:3.7.211:*:pro:*:*:*:*:*","matchCriteriaId":"C281CB19-8EBF-42C8-B37B-4973D7499F59"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2003","CveId":"1309","Ordinal":"1","Title":"CVE-2003-1309","CVE":"CVE-2003-1309","Year":"2003"},"notes":[{"CveYear":"2003","CveId":"1309","Ordinal":"1","NoteData":"The DeviceIoControl function in the TrueVector Device Driver (VSDATANT) in ZoneAlarm before 3.7.211, Pro before 4.0.146.029, and Plus before 4.0.146.029 allows local users to gain privileges via certain signals (aka \"Device Driver Attack\").","Type":"Description","Title":"CVE-2003-1309"},{"CveYear":"2003","CveId":"1309","Ordinal":"2","NoteData":"2006-11-30","Type":"Other","Title":"Published"},{"CveYear":"2003","CveId":"1309","Ordinal":"3","NoteData":"2017-07-28","Type":"Other","Title":"Modified"}]}}}