Rising Antivirus Multiple IOCTL Request Handling Local Privilege Escalation Vulnerabilities

Bugtraq ID:	37951
Class:	Input Validation Error
CVE:	CVE-2010-1591
Remote:	No
Local:	Yes
Published:	Jan 22 2010 12:00AM
Updated:	Apr 13 2015 09:03PM
Credit:	NT Internals
Vulnerable:	Rising Antivirus International Rising Antivirus 2009 0 Rising Antivirus International Rising Antivirus 2008
Not Vulnerable:

Rising Antivirus Multiple IOCTL Request Handling Local Privilege Escalation Vulnerabilities

Rising Antivirus is prone to multiple local privilege-escalation vulnerabilities that affect various drivers.

An attacker can exploit these issues to execute arbitrary code with elevated privileges, facilitating a complete compromise of the affected computer.

The following are vulnerable:

Rising Antivirus 2008
Rising Antivirus 2009

Rising Antivirus Multiple IOCTL Request Handling Local Privilege Escalation Vulnerabilities

The following exploit code is available:

• /data/vulnerabilities/exploits/37951.cpp

Rising Antivirus Multiple IOCTL Request Handling Local Privilege Escalation Vulnerabilities

Solution:
Reports indicate that the vendor has addressed these issues by restricting access to the affected drivers; Symantec has not confirmed this. Please contact the vendor for more information.

Rising Antivirus Multiple IOCTL Request Handling Local Privilege Escalation Vulnerabilities

References:

• NTIADV0805 RISING Antivirus 2008/2009 Multiple Privilege Escalation Vulnerabilit (NT Internals)
  
• NTIADV0902 RISING Antivirus 2008/2009 Privilege Escalation Vulnerability (NT Internals)
  
• Rising Homepage (Rising International Software)
  
• Rising AntiVirus 2008/2009/2010 Local Privilege Escalation Exploit ([email protected])