PT-2010-2456 · Avast · Avast!

Tobias Klein · Publicado 2010-02-25 · Atualizado 2018-10-10 · CVE-2010-0705

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions avast! versions 4.8 through 4.8.1368.0 avast! version 5.0 before 5.0.418.0

Description The issue is related to the Aavmker4.sys driver in avast!, which does not properly validate input to IOCTL 0xb2d60030. This allows local users to cause a denial of service, resulting in a system crash, or execute arbitrary code to gain privileges. The exploitation is done via IOCTL requests using crafted kernel addresses that trigger memory corruption.

Recommendations For avast! versions 4.8 through 4.8.1368.0, update to version 4.8.1368.1 or later. For avast! version 5.0 before 5.0.418.0, update to version 5.0.418.0 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-0705

Produtos afetados

Avast!

Referências · 11

• 🔥 https://exploit-db.com/exploits/12406 · Exploit
• http://trapkit.de/advisories/TKADV2010-003.txt · Nota
• http://securityfocus.com/bid/38363 · Nota
• http://vupen.com/english/advisories/2010/0449 · Aviso do Fabricante
• http://secunia.com/advisories/38677 · Aviso do Fabricante
• http://securitytracker.com/id?1023644 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0705 · Nota de Segurança
• http://securityfocus.com/archive/1/509710/100/0/threaded · Nota
• http://osvdb.org/62510 · Nota
• http://forum.avast.com/index.php?topic=55484.0 · Aviso do Fabricante
• http://secunia.com/advisories/38689 · Aviso do Fabricante