Kingsoft Antivirus 'KAVFM.sys' Driver IOCTL Handling Local Privilege Escalation Vulnerability

Bugtraq ID:	43173
Class:	Design Error
CVE:	CVE-2010-3396
Remote:	No
Local:	Yes
Published:	Sep 13 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	Lufeng Li of Neusoft Corporation
Vulnerable:	Kingsoft Kingsoft Antivirus 2010.04.26.648 Kingsoft Kingsoft Antivirus 0
Not Vulnerable:

Kingsoft Antivirus 'KAVFM.sys' Driver IOCTL Handling Local Privilege Escalation Vulnerability

Kingsoft Antivirus is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to execute arbitrary code with SYSTEM-level privileges and completely compromise the affected computer. Failed exploit attempts will result in a denial-of-service condition.

Kingsoft Antivirus 2010.04.26.648 is vulnerable; other versions may also be affected.

Kingsoft Antivirus 'KAVFM.sys' Driver IOCTL Handling Local Privilege Escalation Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/43173.py

Kingsoft Antivirus 'KAVFM.sys' Driver IOCTL Handling Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Kingsoft Antivirus 'KAVFM.sys' Driver IOCTL Handling Local Privilege Escalation Vulnerability

References:

• Kingsoft Antivirus Homepage (Beijing Kingsoft)