Code injection

2009-07-1317:30:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

The OAmon.sys kernel driver 3.1.0.0 and earlier in Tall Emu Online Armor Personal Firewall AV+ before 3.5.0.12, and Personal Firewall 3.5 before 3.5.0.14, allows local users to gain privileges via crafted METHOD_NEITHER IOCTL requests to \Device\OAmon containing arbitrary kernel addresses, as demonstrated using the 0x830020C3 IOCTL.

CPENameOperatorVersion
online_armor_personal_firewall_av\\+le3.5.0.11
online_armor_personal_firewall_av\\+eq3.5.0.6
online_armor_personal_firewall_av\\+eq3.5.0.9
personal_firewalleq3.5.0.5
personal_firewalleq3.5.0.9
personal_firewalleq3.5.0.1
personal_firewalleq3.5.0.11
personal_firewalleq3.5.0.3
personal_firewalleq3.5.0.4
personal_firewalleq3.5.0.10

Name	Operator	Version
online_armor_personal_firewall_av\\+	le	3.5.0.11
online_armor_personal_firewall_av\\+	eq	3.5.0.6
online_armor_personal_firewall_av\\+	eq	3.5.0.9
personal_firewall	eq	3.5.0.5
personal_firewall	eq	3.5.0.9
personal_firewall	eq	3.5.0.1
personal_firewall	eq	3.5.0.11
personal_firewall	eq	3.5.0.3
personal_firewall	eq	3.5.0.4
personal_firewall	eq	3.5.0.10

Rows per page:

1-10 of 161

References

milw0rm.com/sploits/2009-OAmon_Exp.zip

www.ntinternals.org/ntiadv0806/ntiadv0806.html

www.securityfocus.com/bid/35227

exchange.xforce.ibmcloud.com/vulnerabilities/50960

www.exploit-db.com/exploits/8875