PT-2010-3261 · Beijing Rising International · Rising Antivirus

Publicado 2010-04-28 · Atualizado 2017-08-17 · CVE-2010-1591

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Beijing Rising International Rising Antivirus versions 2008 through 2010

Description The issue arises from improper input validation to certain IOCTLs, including 0x83003C07, allowing local users to gain privileges via crafted IOCTL requests. This affects device drivers such as HookCont.sys, HookNtos.sys, HOOKREG.sys, or HookSys.sys, as well as the RsNTGdi.sys kernel module, which can be reached through DeviceRSNTGDI.

Recommendations For Beijing Rising International Rising Antivirus versions 2008 through 2010, consider disabling the affected device drivers (HookCont.sys, HookNtos.sys, HOOKREG.sys, HookSys.sys) and the RsNTGdi.sys kernel module as a temporary workaround until a patch is available. Restrict access to the IOCTL 0x83003C07 to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-1591

Produtos afetados

Rising Antivirus

Referências · 9

• 🔥 https://exploit-db.com/exploits/11281 · Exploit
• 🔥 http://ntinternals.org/ntiadv0902/ntiadv0902.html · Exploit
• 🔥 http://ntinternals.org/ntiadv0805/ntiadv0805.html · Exploit
• 🔥 http://securityfocus.com/bid/37951 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1591 · Nota de Segurança
• http://osvdb.org/61946 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55869 · Nota
• http://secunia.com/advisories/38335 · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/0218 · Aviso do Fabricante