PT-2024-5375 · Zemana · Zemana Antilogger

Andres Roldan · Published 2024-02-23 · Updated 2024-12-17 · CVE-2024-1853

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Zemana AntiLogger version 2.74.204.664

Description The issue is related to the incorrect validation of a critical resource in the IOCTL Handler component of the zam64.sys and zamguard64.sys drivers in Zemana AntiLogger. This can be exploited to cause a denial of service by triggering the 0x80002048 IOCTL code.

Recommendations For Zemana AntiLogger version 2.74.204.664, as a temporary workaround, consider disabling the zam64.sys and zamguard64.sys drivers until a patch is available. Restrict access to the vulnerable 0x80002048 IOCTL code to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-283

Related Identifiers

BDU:2024-06008

CVE-2024-1853

Affected Products

Zemana Antilogger

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-1853 · Security Note
• https://bdu.fstec.ru/vul/2024-06008 · Security Note
• https://t.me/cvenotify/73913 · Telegram Post
• https://twitter.com/fluidattacks/status/1867271700238250009 · Twitter Post
• https://twitter.com/CVEnew/status/1768403815525482743 · Twitter Post
• https://zemana.com/us/antilogger.html · Note
• https://securitylab.ru/news/550236.php · Note
• https://t.me/cvenotify/73849 · Telegram Post
• https://twitter.com/fluidattacks/status/1869116354973876643 · Twitter Post
• https://twitter.com/fluidattacks/status/1801392354244342032 · Twitter Post
• https://fluidattacks.com/advisories/ellington · Note