PT-2007-2926 · Microsoft · Ndistapi.Sys+2

Published 2007-03-20 · Updated 2018-10-16 · CVE-2007-1537

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP SP2 Microsoft Windows 2003 SP1

Description The issue concerns weak permissions in the DeviceNdisTapi (NDISTAPI.sys) component, allowing local users to write to the device. This can cause a denial of service, demonstrated by using an IRQL to acquire a spinlock on paged memory via the NdisTapiDispatch function.

Recommendations For Microsoft Windows XP SP2, update the system to address the weak permissions issue in the DeviceNdisTapi component. For Microsoft Windows 2003 SP1, update the system to address the weak permissions issue in the DeviceNdisTapi component.

Fix

Related Identifiers

CVE-2007-1537

Affected Products

Ndistapi.Sys

Windows 2003

Windows Xp

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-1537 · Security Note
• http://vupen.com/english/advisories/2007/1031 · Note
• http://securityfocus.com/bid/23025 · Note
• http://secunia.com/advisories/24598 · Note
• http://osvdb.org/33628 · Note
• http://reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=47 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33086 · Note
• http://securityfocus.com/archive/1/463208/100/0/threaded · Note
• http://securityreason.com/securityalert/2471 · Note