PT-2010-3261 · Beijing Rising International · Rising Antivirus

Published 2010-04-28 · Updated 2017-08-17 · CVE-2010-1591

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Beijing Rising International Rising Antivirus versions 2008 through 2010

Description The issue arises from improper input validation to certain IOCTLs, including 0x83003C07, allowing local users to gain privileges via crafted IOCTL requests. This affects device drivers such as HookCont.sys, HookNtos.sys, HOOKREG.sys, or HookSys.sys, as well as the RsNTGdi.sys kernel module, which can be reached through DeviceRSNTGDI.

Recommendations For Beijing Rising International Rising Antivirus versions 2008 through 2010, consider disabling the affected device drivers (HookCont.sys, HookNtos.sys, HOOKREG.sys, HookSys.sys) and the RsNTGdi.sys kernel module as a temporary workaround until a patch is available. Restrict access to the IOCTL 0x83003C07 to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-1591

Affected Products

Rising Antivirus

References · 9

• 🔥 https://exploit-db.com/exploits/11281 · Exploit
• 🔥 http://ntinternals.org/ntiadv0902/ntiadv0902.html · Exploit
• 🔥 http://ntinternals.org/ntiadv0805/ntiadv0805.html · Exploit
• 🔥 http://securityfocus.com/bid/37951 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1591 · Security Note
• http://secunia.com/advisories/38335 · Vendor Advisory
• http://vupen.com/english/advisories/2010/0218 · Vendor Advisory
• http://osvdb.org/61946 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55869 · Note