Symantec products fail to properly limit device driver access to kernel memory

Overview

Certain device drivers included with Symantec products fail to properly verify address space within the “IOCTL” handlers.

Description

Symantec provides Anti-Virus and Internet Security products that are designed to protect users. According to Symantec Security Response SYM06-020:

A specially crafted IRP could be sent to the IOCTL handler function which could allow memory to be overwritten because the address space was not properly validated.
The device drivers NAVENG and NAVEX15 improperly validate address space when processing IOCTL 0x222AD3, 0x222AD7, and 0x222ADB. A specially crafted I/O request packet (IRP) to the IOCTL handler function could overwrite a user supplied address with a constant double word value. Note that this vulnerability only affects the Symantec and Norton anti-virus products for Windows NT, Windows 2000, and Windows XP.

---

Impact

This vulnerability could allow a local attacker to execute arbitrary code with kernel level privileges.

---

Solution

Update
Symantec has addressed this issue with new virus definitions as specified in Symantec Security Response SYM06-020.

---

Vendor Information

946820

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Symantec, Inc. __ Affected

Updated: October 10, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Refer to SYM06-020.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23946820 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://securityresponse.symantec.com/avcenter/security/Content/2006.10.05a.html&gt;
• <http://www.idefense.com/intelligence/vulnerabilities/display.php?id=417&gt;

Acknowledgements

This issue was reported in Symantec Security Response SYM06-020. Symantec credits Ruben Santamarta working with the iDefense Vulnerability Contributor Program for reporting this issue.

This document was written by Chris Taschner.

Other Information

CVE IDs:	CVE-2006-4927
Severity Metric:	3.99 Date Public: