Panda Internet Security/Antivirus+Firewall 2008 CPoint.sys Memory Corruption Vulnerability

Bugtraq ID:	28150
Class:	Boundary Condition Error
CVE:	CVE-2008-1471
Remote:	No
Local:	Yes
Published:	Mar 08 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	Discovery is credited to Tobias Klein.
Vulnerable:	Panda Internet Security 2008 Panda Antivirus + Firewall 2008
Not Vulnerable:

Panda Internet Security/Antivirus+Firewall 2008 CPoint.sys Memory Corruption Vulnerability

Panda Internet Security/Antivirus+Firewall 2008 is prone to a vulnerability that allows local attackers to corrupt kernel memory. This vulnerability occurs because the application fails to sufficiently validate IOCTL requests.

Local users may exploit this vulnerability to cause a denial of service or to execute arbitrary code in the context of the kernel.

Panda Internet Security/Antivirus+Firewall 2008 CPoint.sys Memory Corruption Vulnerability

The following Kartoffel plugin is available:

• /data/vulnerabilities/exploits/panda_plugin.rar

Panda Internet Security/Antivirus+Firewall 2008 CPoint.sys Memory Corruption Vulnerability

Solution:
The vendor has released hotfixes to address this issue. Please see the references for more information.


Panda Antivirus + Firewall 2008

• Panda hft70801s1.exe
  http://www.pandasecurity.com/homeusers/support/card?id=41231&idIdioma= 2&ref=ProdExp

Panda Internet Security 2008

• Panda hfp120801s1.exe
  http://www.pandasecurity.com/homeusers/support/card?id=41337&idIdioma= 2&ref=ProdExp

Panda Internet Security/Antivirus+Firewall 2008 CPoint.sys Memory Corruption Vulnerability

References:

• Panda Internet Security/Antivirus+Firewall 2008 cpoint.sys Kernel Driver Memory (Trapkit)
  
• Vulnerability detected in the Internet protection level control in Panda Antivir (Panda)
  
• Vulnerability detected in the Internet protection level control in Panda Interne (Panda)