PT-2014-6237 · Eset · Eset Personal Firewall

Published 2014-11-04 · Updated 2017-08-29 · CVE-2014-4974

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ESET Personal Firewall versions 5.0 through 7.0

Description The issue allows local users to obtain sensitive information from kernel memory via crafted IOCTL calls. This is related to the ESET Personal Firewall NDIS filter kernel mode driver, also known as the Personal Firewall module, before Build 1212.

Recommendations For versions 5.0 through 7.0, update to a version after Build 1212 (20140609) to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-4974

Affected Products

Eset Personal Firewall

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-4974 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98312 · Note
• http://securityfocus.com/bid/70770 · Note
• http://packetstormsecurity.com/files/128874/ESET-7.0-Kernel-Memory-Leak.html · Note
• http://seclists.org/fulldisclosure/2014/Oct/118 · Note
• https://portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-4974 · Note