The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Kaspersky Labs Anti-Virus IOCTL Local Privilege Escalation
------------------------------------------------------------------------
SUMMARY
<http://www.kaspersky.com/> Kaspersky Anti-Virus provides virus and
spyware protection.
Local exploitation of a design error vulnerability in Kaspersky Labs
Anti-Virus allows an attacker to execute arbitrary code with kernel
privileges.
DETAILS
Vulnerable Systems:
* Kaspersky Labs Anti-Virus version 6.0.0.303 with KLICK and KLIN device
drivers version 2.0.0.281.
The vulnerability specifically exists due to improper address space
validation when the KLIN and KLICK device drivers processes IOCTL
0x80052110. By passing a specially crafted Irp structure to the affected
IOCTL handler, attackers can cause the driver to execute arbitrary code
via a CALL instruction using user supplied data. Execution of data stored
in user-land buffers is trivial.
Exploitation allows attackers to gain elevated privileges by executing
code within kernel context. This allows attackers to gain control of the
affected system. However, local access is required for exploitation to be
successful.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4926>
CVE-2006-4926.
Disclosure Timeline:
* 09/18/2006 - Initial vendor notification
* 09/19/2006 - Initial vendor response
* 10/19/2006 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=425>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=425
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
