PT-2018-5091 · Vmware · Carbon Black

Kyriakos Economou · Published 2018-02-12 · Updated 2018-03-07 · CVE-2016-9569

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Carbon Black version 5.1.1.60603

Description The issue allows local users with admin privileges to cause a denial of service, resulting in an out-of-bounds read and system crash. This is achieved via a large counter value in an IOCTL call, specifically the 0x62430028 call.

Recommendations For Carbon Black version 5.1.1.60603, consider restricting access to the cbstream.sys driver to minimize the risk of exploitation. As a temporary workaround, avoid using large counter values in the 0x62430028 IOCTL call until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2016-9569

Affected Products

Carbon Black

References · 3

• https://osv.dev/vulnerability/CVE-2016-9569 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9569 · Security Note
• https://labs.nettitude.com/blog/carbon-black-security-advisories-cve-2016-9570-cve-2016-9568-and-cve-2016-9569 · Note