PT-2007-6643 · Almico · Speedfan

Publicado 2007-10-23 · Atualizado 2017-07-29 · CVE-2007-5633

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SpeedFan version 4.33

Description The issue allows local users to read or write arbitrary MSRs, gain privileges, and load unsigned drivers via specific IOCTLs to Devicespeedfan. This can be achieved through the IOCTL RDMSR 0x9C402438 and IOCTL WRMSR 0x9C40243C IOCTLs. An example of exploitation is an IOCTL WRMSR action on MSR LSTAR.

Recommendations For SpeedFan version 4.33, consider disabling the IOCTL RDMSR and IOCTL WRMSR functions to minimize the risk of exploitation until a patch is available. Restrict access to the Devicespeedfan device to prevent unauthorized actions.

Exploit

Correção

Identificadores relacionados

CVE-2007-5633

Produtos afetados

Speedfan

Referências · 8

• 🔥 http://bugtrack.almico.com/view.php?id=987 · Exploit
• 🔥 https://exploit-db.com/exploits/30681 · Exploit
• 🔥 http://securityfocus.com/bid/26123 · Exploit
• http://secunia.com/advisories/27312 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5633 · Nota de Segurança
• http://reversemode.com/index.php?option=com_content&task=view&id=42&Itemid=1 · Nota
• http://osvdb.org/41842 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37298 · Nota