CVE-2009-2918

The tgbvpn.sys driver in TheGreenBow IPSec VPN Client 4.61.003 allows local users to cause a denial of service NULL pointer dereference and system crash via a crafted request to the 0x80000034 IOCTL, probably involving an input or output buffer size of 0...

Stack overflow

Off-by-one error in the optionswrite function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count argument, which trigge...

CVE-2009-2450

The OAmon.sys kernel driver 3.1.0.0 and earlier in Tall Emu Online Armor Personal Firewall AV+ before 3.5.0.12, and Personal Firewall 3.5 before 3.5.0.14, allows local users to gain privileges via crafted METHODNEITHER IOCTL requests to \Device\OAmon containing arbitrary kernel addresses, as...

zaptel多个驱动数组索引漏洞

BUGTRAQ ID: 32575 CVECAN ID: CVE-2008-5396,CVE-2008-5744 zaptel软件包是用于配置Zapata电话内核驱动的用户工具。 由于对ZTSPANCONFIG ioctl相关的sync字段缺少检查，导致Zaptel中的torisa.c驱动的torisaspanconfig函数和dahdi/tor2.c驱动的tor2spanconfig函数存在数组索引错误。dialout组中的本地用户可以通过写入/dev/zap/ctl覆盖内核内存中的整数值，导致拒绝服务或获得权限提升。 Diginum Zaptel 1.4.x Diginum Zapt...

CVE-2008-5724

The Personal Firewall driver aka epfw.sys 3.0.672.0 and earlier in ESET Smart Security 3.0.672 and earlier allows local users to gain privileges via a crafted IRP in a certain METHODNEITHER IOCTL request to \Device\Epfw that overwrites portions of memory...

Design/Logic Flaw

The I2O Utility Filter driver i2omgmt.sys 5.1.2600.2180 for Microsoft Windows XP sets Everyone/Write permissions for the "\.\I2OExc" device interface, which allows local users to gain privileges. NOTE: this issue can be leveraged to overwrite arbitrary memory and execute code via an IOCTL call...

Intel Wireless WiFi Link驱动空指针引用漏洞

BUGTRAQ ID: 26842 CVECAN ID: CVE-2007-5938 Wireless WiFi Link是很多笔记本都在使用的无线网卡。 Wireless WiFi Link网卡驱动的实现上存在漏洞，远程攻击者可能利用此漏洞导致用户系统不可用。 Wireless WiFi Link网卡的iwlwifi驱动中compatible/iwl3945-base.c文件的iwlsetrate函数存在空指针引用漏洞： static void iwlsetratestruct iwlpriv priv const struct ieee80211hwmode hw = NULL;...

CVE-2007-4648

The nvcoaft51 driver in Norman Virus Control NVC 5.82 uses weak permissions unrestricted write access for the NvcOa device, which allows local users to gain privileges by 1 triggering a buffer overflow in a kernel pool via a string argument to ioctl 0xBF67201C; or by 2 sending a crafted KEVENT...

Norman Virus Control nvcoaft51.sys ioctl BF672028 Exploit

No description provided by source. / Norman Virus Control nvcoaft51.sys ioctl BF672028 exploit Abstract nvcoaft51.sys driver receive as parameter in some ioctl's a pointer to a KEVENT struct, calling KeSetEvent without any prior check. The device created by the driver NvcOa can be opened by any...

Norman Virus Control - nvcoaft51.sys ioctl BF672028

Norman Virus Control - nvcoaft51.sys ioctl BF672028 / Norman Virus Control nvcoaft51.sys ioctl BF672028 exploit Abstract nvcoaft51.sys driver receive as parameter in some ioctl's a pointer to a KEVENT struct, calling KeSetEvent without any prior check. The device created by the driver NvcOa can b...

ZoneAlarm Insufficient validation of 'vsdatant' driver input buffer Vulnerability

Hello, We would like to inform you about a vulnerability in ZoneAlarm 6. Description: ZoneAlarm insufficiently protects its driver Devicevsdatant against a manipulation by malicious applications and it fails to validate its input buffer. It is possible to open the driver's device and send arbitra...

Design/Logic Flaw

The SymTDI device driver SYMTDI.SYS in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiVirus Corporate Edition 3.0.x through 10.1.x, and other Norton products, allows local users to cause a denial of service system crash by sending crafted data to...

intel-race.txt

Title: Intel 2200BG 802.11 Beacon frame Kernel Memory Corruption Description: The intel wireless mini-pci driver provided with Intel 2200BG cards is vulnerable to a remote race condition memory corruption flaw. Malformed beacons frame can be used to corrupt internal kernel structures,leading to...

Intel 2200BG W29N51.SYS驱动信标帧远程执行代码漏洞

Intel 2200BG是笔记本所使用的mini PCI无线网卡。 Intel 2200BG的网卡驱动W29N51.SYS在处理多个信标帧时存在竞争条件问题，如果攻击者向无线网卡发送了多个特制的信标帧的话，就会覆盖某些内核内存结构，导致执行任意代码。 Intel 2200BG W29N51.SYS 9.0.3.9 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://support.intel.com/support/graphics include unistd.h include sys/types.h include...

Intel 2200BG 802.11 - Beacon frame Kernel Memory Corruption

/ Summary: The intel wireless mini-pci driver provided with Intel 2200BG cards is vulnerable to a remote race condition memory corruption flaw. Malformed beacons frame can be used to corrupt internal kernel structures,leading to arbitrary code execution. This vulnerability is triggered when...

CA Anti-Virus多个驱动本地拒绝服务漏洞

CA Anti-Virus是一款杀毒软件。 CA Anti-Virus的vetfddnt.sys和vetmonnt.sys驱动没有正确地处理空缓冲区，允许本地攻击者通过一些IOCTL（METHODBUFFERED）操作导致蓝屏死机。 Computer Associates Anti-Virus for Vista Beta v8.2 Computer Associates Anti-Virus 2007 v8.1 Computer Associates Internet Security Suite 2007 v3.0 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2006-6496

CA vulnerability CVE-2006-6496 affects CA Anti-Virus 2007 v8.1, CA Anti-Virus for Vista Beta 8.2, and CA Internet Security Suite 2007 v3.0, due to improper handling of NULL buffers in VetMONNT.sys and VetFDDNT.sys that allows a local administrator to crash the system via certain IOCTLs. The issue...

CVE-2006-5379

The accelerated rendering functionality of NVIDIA Binary Graphics Driver binary blob driver For Linux v8774 and v8762, and probably on other operating systems, allows local and remote attackers to execute arbitrary code via a large width value in a font glyph, which can be used to overwrite...

ISS Protection Brief: Vulnerability in Server Driver could result in Denial of Service

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Protection Brief July 28, 2006 Vulnerability in Server Driver could result in Denial of Service Summary: Multiple versions of Microsoft Windows are vulnerable to a null pointer dereference in the server driver srv.sys. By sending a...

Intel Graphics Accelerator Driver - Remote Denial of Service

Intel Graphics Accelerator Driver - Remote Denial of Service source: https://www.securityfocus.com/bid/16127/info The Intel Graphics Accelerator driver is susceptible to a remote denial of service vulnerability. This issue is demonstrated to occur when the affected driver attempts to display an...