Kaspersky Internet Security 6 SSDT Hooks Multiple Local Vulnerabilities
BID:24491
CVE-2006-3074 |Info
Kaspersky Internet Security 6 SSDT Hooks Multiple Local Vulnerabilities
| Bugtraq ID: | 24491 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-5043 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 15 2007 12:00AM |
| Updated: | Sep 25 2007 06:59PM |
| Credit: | Matousec Transparent Security Research discovered these vulnerabilities. |
| Vulnerable: |
Kaspersky Internet Security 6.0.2 .621 Kaspersky Internet Security 6.0.2 .614 Kaspersky Internet Security 7.0.0.125 Kaspersky Internet Security 7.0.0.119 beta Kaspersky Internet Security 7.0 |
| Not Vulnerable: | |
Discussion
Kaspersky Internet Security 6 SSDT Hooks Multiple Local Vulnerabilities
Kaspersky Internet Security 6 is prone to multiple local vulnerabilities.
Exploiting these vulnerabilities allows local attackers to crash affected computers, denying service to legitimate users. Attackers might also be able to gain elevated privileges by executing arbitrary machine code in the context of the kernel, but this has not been confirmed.
Kaspersky Internet Security 6.0.2.614 and 6.0.2.621 are vulnerable; other versions may also be affected.
NOTE: These issues may be related to BID 23326 (Kaspersky Internet Security Suite Klif.SYS Drive Local Heap Overflow Vulnerability), but this has not been confirmed. If we find that this BID is a duplicate, we will retire it and merge its information into BID 23326.
Kaspersky Internet Security 6 is prone to multiple local vulnerabilities.
Exploiting these vulnerabilities allows local attackers to crash affected computers, denying service to legitimate users. Attackers might also be able to gain elevated privileges by executing arbitrary machine code in the context of the kernel, but this has not been confirmed.
Kaspersky Internet Security 6.0.2.614 and 6.0.2.621 are vulnerable; other versions may also be affected.
NOTE: These issues may be related to BID 23326 (Kaspersky Internet Security Suite Klif.SYS Drive Local Heap Overflow Vulnerability), but this has not been confirmed. If we find that this BID is a duplicate, we will retire it and merge its information into BID 23326.
Exploit / POC
Kaspersky Internet Security 6 SSDT Hooks Multiple Local Vulnerabilities
The following exploit code is available:
The following exploit code is available:
Solution / Fix
Kaspersky Internet Security 6 SSDT Hooks Multiple Local Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
References
Kaspersky Internet Security 6 SSDT Hooks Multiple Local Vulnerabilities
References:
References:
- Haxdoors of the Kaspersky Antivirus 6/7 (EP_X0FF)
- Kaspersky Internet Security Product Page (Kaspersky Labs)
- Windows Personal Firewall Analysis (Matousec)
- Kaspersky Multiple insufficient argument validation of hooked SSDT function Vuln (Matousec - Transparent security Research
- Plague in (security) software drivers & BSDOhook utility (Matousec)