PT-2018-17611 · Inca Internet · Nprotect Avs

Publicado 2018-02-02 · Atualizado 2018-02-21 · CVE-2018-6523

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nProtect AVS V4.0 versions prior to 4.0.0.39

Description The issue allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x22045c. This occurs due to a flaw in the driver file TKFsAv.SYS.

Recommendations For nProtect AVS V4.0 versions prior to 4.0.0.39, update to version 4.0.0.39 or later to resolve the issue. As a temporary workaround, consider restricting access to the TKFsAv.SYS driver file to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-6523

Produtos afetados

Nprotect Avs

Referências · 4

• 🔥 https://github.com/ZhiyuanWang-Chengdu-Qihoo360/nProtectAntivirus_POC/tree/master/TKFsAv_0x22045c · Exploit
• http://inca.co.kr/include_file/pdf_down/nProtect%20AVS%20V4%20Vulnerability%20Response%20Release%20Notes.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-6523 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-6523 · Aviso do Fabricante