|
|
|
|
| |
Credit:
The information has been provided by iDefense.
The original article can be found at:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=425
|
| |
Vulnerable Systems:
* Kaspersky Labs Anti-Virus version 6.0.0.303 with KLICK and KLIN device drivers version 2.0.0.281.
The vulnerability specifically exists due to improper address space validation when the KLIN and KLICK device drivers processes IOCTL 0x80052110. By passing a specially crafted Irp structure to the affected IOCTL handler, attackers can cause the driver to execute arbitrary code via a CALL instruction using user supplied data. Execution of data stored in user-land buffers is trivial.
Exploitation allows attackers to gain elevated privileges by executing code within kernel context. This allows attackers to gain control of the affected system. However, local access is required for exploitation to be successful.
CVE Information:
CVE-2006-4926.
Disclosure Timeline:
* 09/18/2006 - Initial vendor notification
* 09/19/2006 - Initial vendor response
* 10/19/2006 - Coordinated public disclosure
|
|
|
|
|
