PT-2009-4289 · Arcabit · Arcavir 2009 Antivirus Protection+3
Published
2009-05-29
·
Updated
2017-09-29
·
CVE-2009-1824
CVSS v2.0
7.2
High
| Vector | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
ArcaVir 2009 Antivirus Protection versions 9.4.3201.9 and earlier
ArcaVir 2009 Internet Security versions 9.4.3202.9 and earlier
ArcaVir 2009 System Protection versions 9.4.3203.9 and earlier
ArcaBit 2009 Home Protection versions 9.4.3204.9 and earlier
Description:
The issue allows local users to gain privileges via crafted METHOD NEITHER IOCTL requests to Deviceps drv containing arbitrary kernel addresses. This can be demonstrated using specific IOCTLs, such as
0x2A7B802B, and possibly others like 0x2A7B8004 and 0x2A7B802F.Recommendations:
For ArcaVir 2009 Antivirus Protection versions 9.4.3201.9 and earlier, consider disabling the
ps drv.sys kernel driver until a patch is available.
For ArcaVir 2009 Internet Security versions 9.4.3202.9 and earlier, restrict access to the Deviceps drv device to minimize the risk of exploitation.
For ArcaVir 2009 System Protection versions 9.4.3203.9 and earlier, avoid using the METHOD NEITHER IOCTL requests to Deviceps drv until the issue is resolved.
For ArcaBit 2009 Home Protection versions 9.4.3204.9 and earlier, as a temporary workaround, consider disabling the ps drv.sys kernel driver until a patch is available.Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Arcabit 2009 Home Protection
Arcavir 2009 Antivirus Protection
Arcavir 2009 Internet Security
Arcavir 2009 System Protection