PT-2007-6183 · Kaspersky+1 · Kaspersky Anti-Virus+2

Published 2007-09-26 · Updated 2011-03-08 · CVE-2007-5086

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus (KAV) and Internet Security version 7.0 build 125

Description The issue arises from improper validation of certain parameters to System Service Descriptor Table (SSDT) and Shadow SSDT function handlers, allowing local users to cause a denial of service (crash) via various kernel SSDT hooks in kylif.sys, including NtUserSendInput, LoadLibraryA, NtOpenProcess, NtOpenThread, NtTerminateProcess, NtUserFindWindowEx, and NtUserBuildHwndList. Additionally, the NtDuplicateObject (DuplicateHandle) kernel SSDT hook is potentially affected.

Recommendations For Kaspersky Anti-Virus (KAV) and Internet Security version 7.0 build 125, consider disabling the vulnerable kernel SSDT hooks in kylif.sys as a temporary workaround until a patch is available. Restrict access to the NtUserSendInput, LoadLibraryA, NtOpenProcess, NtOpenThread, NtTerminateProcess, NtUserFindWindowEx, and NtUserBuildHwndList functions to minimize the risk of exploitation. Avoid using the NtDuplicateObject (DuplicateHandle) function in the affected kernel SSDT hook until the issue is resolved.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-5086

Affected Products

Kaspersky Anti-Virus

Kaspersky Internet Security

Windows

References · 7

• 🔥 http://rootkit.com/newsread.php?newsid=778 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5086 · Security Note
• http://secunia.com/advisories/26887 · Vendor Advisory
• http://vupen.com/english/advisories/2007/3259 · Note
• http://kaspersky.com/technews?id=203038706 · Note
• http://osvdb.org/37990 · Note
• http://frsirt.com/english/advisories/2007/3259 · Note