PT-2008-6777 · Entech Taiwan+1 · Powerstrip+1

Publicado 2008-12-26 · Atualizado 2017-09-29 · CVE-2008-5725

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EnTech Taiwan PowerStrip versions 3.84 and earlier NT kernel-mode driver (aka pstrip.sys) version 5.0.1.1 and earlier

Description The issue allows local users to gain privileges by exploiting certain IRP parameters in an IOCTL request to the API endpoint "DevicePowerstrip1", which can overwrite portions of memory.

Recommendations For EnTech Taiwan PowerStrip versions 3.84 and earlier, update to a version later than 3.84 to resolve the issue. For NT kernel-mode driver (aka pstrip.sys) version 5.0.1.1 and earlier, update to a version later than 5.0.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the "DevicePowerstrip1" API endpoint to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-5725

Produtos afetados

Ntfs Kernel-Mode Driver

Powerstrip

Referências · 7

• 🔥 http://ntinternals.org/ntiadv0810/ntiadv0810.html · Exploit
• 🔥 https://exploit-db.com/exploits/7533 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5725 · Nota de Segurança
• http://securityreason.com/securityalert/4809 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47532 · Nota
• http://securityfocus.com/bid/32961 · Nota
• http://secunia.com/advisories/33249 · Aviso do Fabricante