Compuware Softice DbgMsg.sys Denial Of Service Vulnerability

Bugtraq ID:	13813
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	May 30 2005 12:00AM
Updated:	May 30 2005 12:00AM
Credit:	Discovery of this issue is credited to Piotr Bania <[email protected]>.
Vulnerable:	Compuware DriverStudio 3.2 Compuware DriverStudio 3.1
Not Vulnerable:

Compuware Softice DbgMsg.sys Denial Of Service Vulnerability

The Compuware Softice 'DbgMsg.sys' driver, is prone to a denial of service issue.

Reports indicate that this issue manifests because a pointer to Debug strings handled in the vulnerable 'DbgMsg.sys' function is not properly validated.

An attacker may exploit this issue to effectively deny service for legitimate users.

Compuware Softice DbgMsg.sys Denial Of Service Vulnerability

An exploit was written by the discoverer of this issue, this exploit is not believed to be public. However, exploitation of this issue is trivial.

Compuware Softice DbgMsg.sys Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Compuware Softice DbgMsg.sys Denial Of Service Vulnerability

References:

• SoftICE Driver Suite Homepage (Compuware)
  
• Compuware Softice (DbgMsg driver) Local Denial Of Service (Piotr Bania )