Multiple vulnerabilities in Norman NVC 5.82 driver

2007.09.04
Credit: InocraM
Risk: Low
Local: Yes
Remote: No
CWE: CWE-119


CVSS Base Score: 7.2/10
Impact Subscore: 10/10
Exploitability Subscore: 3.9/10
Exploit range: Local
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

Abstract: There are multiple bugs in nvcoaft51 driver from Norman products. These bugs could be locally exploited by a malicious user in order to gain unlimited access to the system. Nvcoaft51 driver creates a device named NvcOa without a restrictive security descriptor, so any user can open it and send control codes directly to the device driver. Arbitrary code execution at kernel mode is possible because the code that manages IOCTL's is not bug free. Detailed information and proof of concept exploit code of a tricky kernel pool overflow can be downloaded here : http://www.48bits.com/exploits/nvc.rar Cheers, InocraM ? inocram[at]48bits[dot]com [48Bits I+D Team]


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top