PT-2018-17665 · Malwarefox · Malwarefox Antimalware

Souhail Hammou · Publicado 2018-02-04 · Atualizado 2023-12-27 · CVE-2018-6606

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MalwareFox AntiMalware version 2.74.0.150

Description The issue is related to improper access control in the zam32.sys and zam64.sys drivers, which allows a non-privileged process to elevate privileges. This can be achieved by sending specific IOCTL commands, such as IOCTL 0x80002010 and IOCTL 0x8000204C, to the .ZemanaAntiMalware endpoint. There is also a mention of exploiting this issue using a VBA/Word document, but details are not provided.

Recommendations For MalwareFox AntiMalware version 2.74.0.150, consider restricting access to the zam32.sys and zam64.sys drivers to prevent non-privileged processes from registering themselves and elevating privileges. Avoid using the IOCTL 0x80002010 and IOCTL 0x8000204C commands to the .ZemanaAntiMalware endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-6606

Produtos afetados

Malwarefox Antimalware

Referências · 5

• 🔥 https://github.com/SouhailHammou/Exploits/blob/master/CVE-2018-6606/Malwarefox_privescl_1.c · Exploit
• 🔥 https://exploit-db.com/exploits/43987 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-6606 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-6606 · Aviso do Fabricante
• https://twitter.com/S0ufi4n3/status/1740018036705464784 · Publicação no Twitter