PT-2018-17610 · Inca Internet · Nprotect Avs

Publicado 2018-02-02 · Atualizado 2018-02-21 · CVE-2018-6522

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nProtect AVS V4.0 versions prior to 4.0.0.39

Description The issue allows local users to cause a denial of service, potentially resulting in a Blue Screen of Death (BSOD), due to the driver file TKRgFtXp.SYS not validating input values from the IOCtl 0x220408. This could possibly have other unspecified impacts.

Recommendations For nProtect AVS V4.0 versions prior to 4.0.0.39, update to version 4.0.0.39 or later to resolve the issue. As a temporary workaround, consider restricting access to the TKRgFtXp.SYS driver file to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-6522

Produtos afetados

Nprotect Avs

Referências · 4

• 🔥 https://github.com/ZhiyuanWang-Chengdu-Qihoo360/nProtectAntivirus_POC/tree/master/TKRgFtXp_0x220408 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-6522 · Nota de Segurança
• http://inca.co.kr/include_file/pdf_down/nProtect%20AVS%20V4%20Vulnerability%20Response%20Release%20Notes.pdf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-6522 · Aviso do Fabricante