PT-2008-6777 · Entech Taiwan+1 · Powerstrip+1

Published 2008-12-26 · Updated 2017-09-29 · CVE-2008-5725

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EnTech Taiwan PowerStrip versions 3.84 and earlier NT kernel-mode driver (aka pstrip.sys) version 5.0.1.1 and earlier

Description The issue allows local users to gain privileges by exploiting certain IRP parameters in an IOCTL request to the API endpoint "DevicePowerstrip1", which can overwrite portions of memory.

Recommendations For EnTech Taiwan PowerStrip versions 3.84 and earlier, update to a version later than 3.84 to resolve the issue. For NT kernel-mode driver (aka pstrip.sys) version 5.0.1.1 and earlier, update to a version later than 5.0.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the "DevicePowerstrip1" API endpoint to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-5725

Affected Products

Ntfs Kernel-Mode Driver

Powerstrip

References · 7

• 🔥 http://ntinternals.org/ntiadv0810/ntiadv0810.html · Exploit
• 🔥 https://exploit-db.com/exploits/7533 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5725 · Security Note
• http://secunia.com/advisories/33249 · Vendor Advisory
• http://securityreason.com/securityalert/4809 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47532 · Note
• http://securityfocus.com/bid/32961 · Note