PT-2008-3179 · Avast · Avast!

Published 2008-04-02 · Updated 2018-10-11 · CVE-2008-1625

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions avast! Home and Professional version 4.7

Description The issue is related to the improper validation of input to IOCTL 0xb2d60030 in the aavmker4.sys driver. This allows local users to gain privileges via certain IOCTL requests.

Recommendations For avast! Home and Professional version 4.7, consider restricting access to the IOCTL 0xb2d60030 request until a patch is available. As a temporary workaround, disabling the aavmker4.sys driver may prevent exploitation, but this may impact system functionality. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1625

Affected Products

Avast!

References · 10

• 🔥 https://exploit-db.com/exploits/12406 · Exploit
• http://secunia.com/advisories/29605 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1625 · Security Note
• http://securityfocus.com/archive/1/490321/100/0/threaded · Note
• http://trapkit.de/advisories/TKADV2008-002.txt · Note
• http://avast.com/eng/avast-4-home_pro-revision-history.html · Note
• http://vupen.com/english/advisories/2008/1034/references · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41527 · Note
• http://securityfocus.com/bid/28502 · Note
• http://securitytracker.com/id?1019732 · Note