WinPcap NPF.SYS Bpf_Filter_Init Function Local Privilege Escalation Vulnerability

Bugtraq ID:	26409
Class:	Boundary Condition Error
CVE:	CVE-2007-5756
Remote:	No
Local:	Yes
Published:	Nov 12 2007 12:00AM
Updated:	Nov 13 2007 07:25PM
Credit:	The discoverer of this vulnerability wishes to remain anonymous.
Vulnerable:	WinPcap WinPcap 4.0.1
Not Vulnerable:	WinPcap WinPcap 4.0.2

WinPcap NPF.SYS Bpf_Filter_Init Function Local Privilege Escalation Vulnerability

WinPcap is prone to a local privilege-escalation vulnerability.

An attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers.

Note that an administrator must load the vulnerable driver ('NPF.SYS') by executing an application that depends on it. By default, the driver is not loaded; it can be loaded only by administrative users.

WinPcap 4.0.1 is vulnerable to this issue; previous versions may also be affected.

WinPcap NPF.SYS Bpf_Filter_Init Function Local Privilege Escalation Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WinPcap NPF.SYS Bpf_Filter_Init Function Local Privilege Escalation Vulnerability

Solution:
The vendor has released WinPcap 4.0.2 to address this issue; please see the references for details.


WinPcap WinPcap 4.0.1

• WinPcap WinPcap_4_0_2.exe
  http://www.winpcap.org/install/bin/WinPcap_4_0_2.exe

WinPcap NPF.SYS Bpf_Filter_Init Function Local Privilege Escalation Vulnerability

References:

• WinPcap Change Log (WinPcap)
  
• WinPcap Web Site (WinPcap)
  
• iDefense Security Advisory 11.12.07: WinPcap NPF.SYS bpf_filter_init Arbitrary A (iDefense Labs )