PT-2007-6732 · Riverbed+1 · Winpcap+2

Published 2007-11-13 · Updated 2024-02-09 · CVE-2007-5756

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WinPcap versions prior to 4.0.2

Description The issue is related to multiple array index errors in the bpf filter init function in NPF.SYS, which occurs when WinPcap is run in monitor mode. This can be exploited by local users via crafted IOCTL requests to gain privileges. The affected software is used in Wireshark and possibly other products.

Recommendations For versions prior to 4.0.2, update to version 4.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the bpf filter init function until a patch is available. Avoid using the IOCTL requests that can trigger the array index errors in the affected function.

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2007-5756

Affected Products

Npf.Sys

Winpcap

Wireshark

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2007-5756 · Security Note
• http://secunia.com/advisories/27676 · Vendor Advisory
• http://securityfocus.com/bid/26409 · Note
• http://vupen.com/english/advisories/2007/3835 · Note
• http://frsirt.com/english/advisories/2007/3835 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=625 · Note
• http://securitytracker.com/id?1018935 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38433 · Note
• http://xforce.iss.net/xforce/xfdb/38433 · Note
• http://winpcap.org/misc/changelog.htm · Note