PT-2019-1398 · Wibu Systems · Wibukey.Sys

Published 2019-01-28 · Updated 2022-04-19 · CVE-2018-3990

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WibuKey.sys version 6.40 (Build 2400)

Description The issue is related to a buffer overflow in the 0x8200E804 IOCTL handler functionality of WibuKey.sys. This can be exploited by sending a specially crafted IRP request, leading to kernel memory corruption and potentially allowing privilege escalation.

Recommendations For version 6.40 (Build 2400), consider disabling the 0x8200E804 IOCTL handler functionality until a patch is available to prevent potential exploitation. Restrict access to the WibuKey.sys module to minimize the risk of kernel memory corruption. Avoid using specially crafted IRP requests to the 0x8200E804 IOCTL handler until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2019-00770

CVE-2018-3990

Affected Products

Wibukey.Sys

References · 9

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0658 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3990 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-3989 · Security Note
• https://bdu.fstec.ru/vul/2019-00770 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3990 · Vendor Advisory
• http://securityfocus.com/bid/107005 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-760124.pdf · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-844562.pdf · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-902727.pdf · Note