PT-2018-17611 · Inca Internet · Nprotect Avs

Published 2018-02-02 · Updated 2018-02-21 · CVE-2018-6523

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nProtect AVS V4.0 versions prior to 4.0.0.39

Description The issue allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x22045c. This occurs due to a flaw in the driver file TKFsAv.SYS.

Recommendations For nProtect AVS V4.0 versions prior to 4.0.0.39, update to version 4.0.0.39 or later to resolve the issue. As a temporary workaround, consider restricting access to the TKFsAv.SYS driver file to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-6523

Affected Products

Nprotect Avs

References · 4

• 🔥 https://github.com/ZhiyuanWang-Chengdu-Qihoo360/nProtectAntivirus_POC/tree/master/TKFsAv_0x22045c · Exploit
• http://inca.co.kr/include_file/pdf_down/nProtect%20AVS%20V4%20Vulnerability%20Response%20Release%20Notes.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6523 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6523 · Vendor Advisory