[Reversemode Advisory] Kaspersky Anti-Virus Privilege Escalation

Hi, Kaspersky Products are prone to a local privilege escalation. Unprivileged users can exploit this flaw in order to execute arbitrary code with Kernel privileges. Kaspersky implements its NDIS-TDI Hooking Engine using two drivers, which rely on an internal system of plugins. Plugin registering...

CVE-2006-4926

The NDIS-TDI Hooking Engine, as used in the 1 KLICK KLICK.SYS and 2 KLIN KLIN.SYS device drivers 2.0.0.281 for in Kaspersky Labs Anti-Virus 6.0.0.303 and other Anti-Virus and Internet Security products, allows local users to execute arbitrary code via crafted Irp structure with invalid addresses ...

CVE-2006-4926

CVE-2006-4926 concerns a local privilege escalation in Kaspersky Anti-Virus 6.0.0.303 related to the NDIS-TDI Hooking Engine used by the KLICK.KILIN drivers (KLICK.SYS, KLIN.SYS) v2.0.0.281. Affected components process IOCTL 0x80052110 and an invalid address in crafted IRP structures, enabling lo...