360.cn Qihoo 360 Security Guard 'bregdrv.sys' Edit Registry Local Privilege Escalation Vulnerability

Bugtraq ID:	38037
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 02 2010 12:00AM
Updated:	Feb 02 2010 12:00AM
Credit:	[email protected]
Vulnerable:	360.cn Qihoo 360 Security Guard 6.1.5 .1009
Not Vulnerable:

360.cn Qihoo 360 Security Guard 'bregdrv.sys' Edit Registry Local Privilege Escalation Vulnerability

360.cn Qihoo 360 Security Guard is prone a local privilege-escalation vulnerability.

An attacker can exploit this issue to modify registry entries with kernel-level privileges. Successful attacks will lead to a complete compromise of an affected computer.

Qihoo 360 Security Guard 6.1.5.1009 is vulnerable; other versions may also be affected.

360.cn Qihoo 360 Security Guard 'bregdrv.sys' Edit Registry Local Privilege Escalation Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/38037.c

360.cn Qihoo 360 Security Guard 'bregdrv.sys' Edit Registry Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

360.cn Qihoo 360 Security Guard 'bregdrv.sys' Edit Registry Local Privilege Escalation Vulnerability

References:

• Vendor Homepage (360.cn)
  
• 360 Security Guard breg device drivers Privilege Escalation Vulnerabilitie ([email protected])