DESLock+ IOCTL Request Local Code Execution and Denial of Service Vulnerabilities

Bugtraq ID:	27862
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 18 2008 12:00AM
Updated:	Feb 21 2008 04:23PM
Credit:	mu-b is credited with the discovery of these issues.
Vulnerable:	Data Encryption Systems DESlock+ 3.2.6
Not Vulnerable:

DESLock+ IOCTL Request Local Code Execution and Denial of Service Vulnerabilities

DESlock+ is prone to multiple vulnerabilities that allow arbitrary code to run with SYSTEM-level privileges or cause denial-of-service conditions.

Local attackers can exploit these issues to execute arbitrary code with SYSTEM-level privileges. Successful attacks will completely compromise the computer or cause a denial of service.

DESlock+ 3.2.6 and prior versions are vulnerable.

DESLock+ IOCTL Request Local Code Execution and Denial of Service Vulnerabilities

The following exploit code is available:

• /data/vulnerabilities/exploits/27862-deslock-list-leak.c
• /data/vulnerabilities/exploits/27862-deslock-list-zero.c
• /data/vulnerabilities/exploits/27862-deslock-list-zero-v2.c
• /data/vulnerabilities/exploits/27862-deslock-pown-v2.c

DESLock+ IOCTL Request Local Code Execution and Denial of Service Vulnerabilities

Solution:
Currently we are not aware of any working exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

DESLock+ IOCTL Request Local Code Execution and Denial of Service Vulnerabilities

References:

• DESlock+ Homepage (Data Encryption Systems)