Rising Antivirus SSDT 'NtOpenProcess()' Hook Local Denial of Service Vulnerability

Bugtraq ID:	28744
Class:	Design Error
CVE:	CVE-2008-1738
Remote:	No
Local:	Yes
Published:	Apr 28 2008 12:00AM
Updated:	Apr 28 2008 11:36PM
Credit:	Anibal Sacco from Core Security Technologies exploit writers team
Vulnerable:	Rising Antivirus International Rising Antivirus 19.66.0.0 Rising Antivirus International Rising Antivirus 19.60.0.0
Not Vulnerable:

Rising Antivirus SSDT 'NtOpenProcess()' Hook Local Denial of Service Vulnerability

Rising Antivirus is prone to a local denial-of-service vulnerability.

Exploiting this vulnerability allows local attackers to crash affected computers, denying service to legitimate users.

Rising Antivirus 19.60.0.0 and 19.66.0.0 are vulnerable; other versions may also be affected.

Rising Antivirus SSDT 'NtOpenProcess()' Hook Local Denial of Service Vulnerability

To exploit these issues, attackers can use 'BSODhook' from Matousec.

Rising Antivirus SSDT 'NtOpenProcess()' Hook Local Denial of Service Vulnerability

Solution:
The vendor has released a fix. Please the references for details.


Rising Antivirus International Rising Antivirus 19.60.0.0

• Rising Antivirus International ravolusrfree.exe
  http://rsdownload.rising.com.cn/for_down/rsfree/ravolusrfree.exe

Rising Antivirus International Rising Antivirus 19.66.0.0

• Rising Antivirus International ravolusrfree.exe
  http://rsdownload.rising.com.cn/for_down/rsfree/ravolusrfree.exe

Rising Antivirus SSDT 'NtOpenProcess()' Hook Local Denial of Service Vulnerability

References:

• Rising Homepage (Rising International Software)
  
• Windows Personal Firewall Analysis (Matousec)
  
• Plague in (security) software drivers & BSDOhook utility (Matousec)
  
• CORE-2008-0320 Insufficient argument validation of hooked SSDT functions on mult (Core Security Technologies)