Panda Global Protection 2010 Multiple IOCTL Local Privilege Escalation Vulnerabilities

Bugtraq ID:	45947
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 21 2011 12:00AM
Updated:	Jan 21 2011 12:00AM
Credit:	Heurs
Vulnerable:	Panda Global Protection 2010
Not Vulnerable:

Panda Global Protection 2010 Multiple IOCTL Local Privilege Escalation Vulnerabilities

Panda Global Protection is prone to multiple local privilege-escalation vulnerabilities.

Local attackers can exploit this issue to execute arbitrary code with superuser privileges and completely compromise the affected computer. Failed exploit attempts will result in a denial-of-service condition.

Panda Global Protection 2010 is vulnerable; other versions may also be affected.

Panda Global Protection 2010 Multiple IOCTL Local Privilege Escalation Vulnerabilities

The following proofs of concept are available:

• /data/vulnerabilities/exploits/45947.c
• /data/vulnerabilities/exploits/45947-1.c

Panda Global Protection 2010 Multiple IOCTL Local Privilege Escalation Vulnerabilities

Solution:
Reports indicate that the vendor has addressed these issues by restricting access to the affected drivers; this has not been confirmed. Please contact the vendor for more information.

Panda Global Protection 2010 Multiple IOCTL Local Privilege Escalation Vulnerabilities

References:

• Panda Global Protection Homepage (Panda Security)