PT-2012-1383 · Agnitum · Outpost Security Suite Pro

Name of the Vulnerable Software and Affected Versions: Outpost Security Suite Pro versions 6.7.3.3063.452.0726 and 7.0.3330.505.1221 BETA Description: A race condition issue allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a...

PT-2012-1372 · Eset · Eset Smart Security

Name of the Vulnerable Software and Affected Versions: ESET Smart Security version 4.2.35.3 Description: A race condition in ESET Smart Security on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not...

PT-2012-1386 · Prevx · Prevx

Name of the Vulnerable Software and Affected Versions: Prevx version 3.0.5.143 Description: A race condition exists that allows local users to bypass kernel-mode hook handlers and execute dangerous code. This is achieved through certain user-space memory changes during hook-handler execution. The...

PT-2012-1373 · F Secure · F-Secure Internet Security

Name of the Vulnerable Software and Affected Versions: F-Secure Internet Security 2010 version 10.00 build 246 Description: A race condition allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by...

PT-2012-1388 · Unknown · Security Shield 2010

Name of the Vulnerable Software and Affected Versions: Security Shield 2010 version 13.0.16.313 Description: A race condition exists that allows local users to bypass kernel-mode hook handlers and execute dangerous code. This is achieved through certain user-space memory changes during hook-handl...

PT-2012-1368 · Ca · Ca Internet Security Suite

Name of the Vulnerable Software and Affected Versions: CA Internet Security Suite Plus 2010 version 6.0.0.272 Description: A race condition allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by...

PT-2012-1379 · Norman · Norman Security Suite

Name of the Vulnerable Software and Affected Versions: Norman Security Suite PRO version 8.0 Description: A race condition exists in the software, allowing local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked. This is achieved through certain...

PT-2012-1393 · Vipre · Vipre Antivirus Premium

Name of the Vulnerable Software and Affected Versions: VIPRE Antivirus Premium version 4.0.3272 Description: A race condition allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware...

PT-2012-1389 · Sophos · Sophos Endpoint Security/Control

Name of the Vulnerable Software and Affected Versions: Sophos Endpoint Security and Control version 9.0.5 Description: A race condition exists that allows local users to bypass kernel-mode hook handlers and execute dangerous code. This is achieved through certain user-space memory changes during...

PT-2012-1394 · Virusbuster · Virusbuster Internet Security Suite

Name of the Vulnerable Software and Affected Versions: VirusBuster Internet Security Suite version 3.2 Description: A race condition issue allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by...

PT-2012-1387 · Microsoft · Privatefirewall

Name of the Vulnerable Software and Affected Versions: PrivateFirewall version 7.0.20.37 Description: A race condition in PrivateFirewall on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by...

PT-2012-1370 · Defensewall · Defensewall Personal Firewall

Name of the Vulnerable Software and Affected Versions: DefenseWall Personal Firewall version 3.00 Description: A race condition in DefenseWall Personal Firewall on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a...

PT-2012-1366 · Bitdefender · Bitdefender Total Security

Name of the Vulnerable Software and Affected Versions: BitDefender Total Security 2010 version 13.0.20.347 Description: A race condition allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-base...

PT-2012-1392 · Vba32 · Vba32 Personal

Name of the Vulnerable Software and Affected Versions: VBA32 Personal version 3.12.12.4 Description: A race condition exists that allows local users to bypass kernel-mode hook handlers and execute dangerous code. This is achieved through certain user-space memory changes during hook-handler...

PT-2012-1382 · Online Solutions · Online Solutions Security Suite

Name of the Vulnerable Software and Affected Versions: Online Solutions Security Suite version 1.5.14905.0 Description: A race condition exists in the software, allowing local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked. This is achieved...

PT-2012-1395 · Webroot · Webroot Internet Security Essentials

Name of the Vulnerable Software and Affected Versions: Webroot Internet Security Essentials version 6.1.0.145 Description: A race condition exists that allows local users to bypass kernel-mode hook handlers and execute dangerous code. This is achieved through certain user-space memory changes...

PT-2012-1374 · G Data · G Data Totalcare

Name of the Vulnerable Software and Affected Versions: G DATA TotalCare version 2010 Description: A race condition in G DATA TotalCare 2010 on Windows XP allows local users to bypass kernel-mode hook handlers and execute dangerous code that would otherwise be blocked by a handler but not blocked ...

SpyDLLRemover v4.0 - New Version Realeased

"SpyDllRemover is the specialized tool for detecting spyware & hidden Rootkit Dlls in the System. It can also detect & remove user-land Rootkit processes as well as other spyware processes using multiple user-land Rootkit detection algorithms coupled with in-house Process heuristics. This makes i...

Rising AntiVirus 2008/2009/2010 - Local Privilege Escalation

//by Dlrow [email protected] //restore all ssdt hooks // Rising0day.cpp : Defines the entry point for the console application. // include "stdafx.h" include "windows.h" enum SystemModuleInformation = 11 ; typedef struct ULONG Unknown1; ULONG Unknown2; PVOID Base; ULONG Size; ULONG Flags; USHORT...

Researchers Create Hypervisor Tool for Rootkits

Research between North Carolina State and Microsoft has garnered a way to better isolate and centralize kernels–up to 6,000 different kernel hooks–and has stopped nine rootkits. The tool is called HookSafe and runs on Ubuntu Linux 8.04 and uses hardware-based memory. At issue is whether other...