PT-2016-1175 · Sncc0.Sys+1 · Sncc0.Sys+2

Published 2016-02-24 · Updated 2016-02-24

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Secret Net and Secret Net Studio (affected versions not specified)

Description The issue is related to a kernel driver vulnerability in the sncc0.sys driver, which is part of the Secret Net and Secret Net Studio information protection systems. This vulnerability involves the transmission of pointers from a user-mode application to the kernel driver through an IOCTL input buffer in the Sub 180009D50 function. Exploitation of this issue could allow a local attacker to bypass the driver signature enforcement mechanism (DSE) and elevate privileges from user level to kernel level by running a specially crafted user application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2016-00436

Affected Products

Secret Net

Secret Net Studio

Sncc0.Sys

References · 4

• https://bdu.fstec.ru/vul/2016-00436 · Security Note
• https://github.com/cr4sh/secretnet_expl · Note
• http://blog.cr4.sh/2016/02/exploiting-smm-callout-vulnurabilities.html · Note
• http://securitycode.ru/company/news/vsn6uu · Note