瑞星杀病毒多个IOCTL请求处理本地特权提升漏洞

Bugraq ID: 37951 RISING Antivirus 2008/2009是国内流行的杀病毒程序。 RISING Antivirus 2008/2009不正确处理IOCTL请求，本地攻击者可以利用漏洞提升特权。 部分设备驱动RsNTGdi.sys, HookCont.sys, HookNtos.sys, HOOKREG.sys和HookSys.sys在处理IOCTLs请求时存在错误，提交特殊构建的IOCTL可破坏内核内存，导致以内核空间上下文执行任意代码。 Rising Antivirus International Rising Antivirus 2009 Rising...

Rising AntiVirus 2008/2009/2010 Local Privilege Escalation Exploit

RsNtGdi.sys not verify the Irp-UserBuffer address. Exploit code will restore all of the kernel SSDT hook Rising AntiVirus 2008 / 2009 / 2010 none include "stdafx.h" include "windows.h" enum SystemModuleInformation = 11 ; typedef struct ULONG Unknown1; ULONG Unknown2; PVOID Base; ULONG Size; ULONG...

Rising AntiVirus 2008/2009/2010 Local Privilege Escalation Exploit

// Rising0day.cpp : Defines the entry point for the console application. // include "stdafx.h" include "windows.h" enum SystemModuleInformation = 11 ; typedef struct ULONG Unknown1; ULONG Unknown2; PVOID Base; ULONG Size; ULONG Flags; USHORT Index; USHORT NameLength; USHORT LoadCount; USHORT...

Cisco Defines Cybercrime ROI

The Cisco Cybercrime Return on Investment Matrix identifies the innovative and lucrative banking Trojan Zeus, as well as successful Web exploits that have dominated cybercrime as “rising stars.” Read the full article. TechTarget...

In the Rising-2 0 1 0 full protection under the created folder-vulnerability warning-the black bar safety net

program createfolder; uses Windows; const DIRECTORYALLACCESS = STANDARDRIGHTSREQUIRED or $F; FILECREATE = $0 0 0 0 0 0 0 2; FILEDIRECTORYFILE = $0 0 0 0 0 0 0 1; OBJCASEINSENSITIVE = $0 0 0 0 0 0 4 0; type NTSTATUS = ULONG; PUnicodeString = ^TUnicodeString; TUnicodeString = packed record Length:...

瑞星杀毒软件不安全文件权限漏洞

BUGTRAQ ID: 36836 瑞星是中国的一家非常著名的杀毒软件厂商。 瑞星杀毒软件和防火墙等产品的程序文件默认设置了不安全的权限（Users: Full Control）： ... snip .... C:\Program Files\Rising\RFW\CCenter.exe BUILTIN\Utilisateurs:F BUILTIN\Utilisateurs avec pouvoir:C BUILTIN\Administrateurs:F AUTORITE NT\SYSTEM:F FUZZYXP\francis:F ... snip ... ... snip...

Rising Multiple Products Local Privilege Escalation Vulnerability

ShineShadow Security Report 28102009-13 TITLE Rising Multiple Products Local Privilege Escalation Vulnerability BACKGROUND RISING has introduced a variety of operating system based antivirus software, firewall software and enterprise antivirus wall, firewall, network security warning system and...

Rising Firewall 2009 Privilege Escalation

No description provided by source. Application: Rising Firewall 2009 Platforms: Windows XP Professional SP2 Exploitation: Privilege Escalation Date: 2009-10-26 Author: Francis Provencher Protek Research Lab's 1 Introduction 2 Technical details 3 The Code N/A =============== 1 Introduction...

Rising Multiple Products Local Privilege Escalation Vulnerability

No description provided by source. ShineShadow Security Report 28102009-13 TITLE Rising Multiple Products Local Privilege Escalation Vulnerability BACKGROUND RISING has introduced a variety of operating system based antivirus software, \ firewall software and enterprise antivirus wall, firewall,...

Rising Antivirus 2009 Privilege Escalation

No description provided by source. Application: Rising Antivirus 2009 Platforms: Windows XP Professional SP2 Exploitation: Privilege Escalation Date: 2009-10-26 Author: Francis Provencher Protek Research Lab's 1 Introduction 2 Technical details 3 The Code N/A =============== 1 Introduction...

{PRL} Rising Antivirus 2009 Privilege Escalation

Application: Rising Antivirus 2009 Platforms: Windows XP Professional SP2 Exploitation: Privilege Escalation Date: 2009-10-26 Author: Francis Provencher Protek Research Lab's 1 Introduction 2 Technical details 3 The Code N/A =============== 1 Introduction...

{PRL} Rising Firewall 2009 Privilege Escalation

Application: Rising Firewall 2009 Platforms: Windows XP Professional SP2 Exploitation: Privilege Escalation Date: 2009-10-26 Author: Francis Provencher Protek Research Lab's 1 Introduction 2 Technical details 3 The Code N/A =============== 1 Introduction...

CVE-2008-5539

RISING Antivirus 21.06.31.00 and possibly 20.61.42.00, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, ...

Design/Logic Flaw

RISING Antivirus 21.06.31.00 and possibly 20.61.42.00, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, ...

CVE-2008-5539

RISING Antivirus 21.06.31.00 and possibly 20.61.42.00, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, ...

CVE-2008-5539

CVE-2008-5539 describes a bypass of malware detection in RISING Antivirus 21.06.31.00 (and possibly 20.61.42.00) when IE6/IE7 is used, by prepending an MZ header to an HTML document and renaming the file with no extension, .txt, or .jpg, as demonstrated by a CVE-2006-5745 exploit. Connected recor...

Code injection

Rising Antivirus 2008 before 20.38.20 allows local users to cause a denial of service system crash via an invalid pointer to the CLIENTID structure in a call to the NtOpenProcess hooked System Service Descriptor Table SSDT function...

CVE-2008-1738

Rising Antivirus 2008 before 20.38.20 allows local users to cause a denial of service system crash via an invalid pointer to the CLIENTID structure in a call to the NtOpenProcess hooked System Service Descriptor Table SSDT function...

瑞星杀毒软件SSDT NtOpenProcess()钩子本地拒绝服务漏洞

BUGTRAQ ID: 28744 CVECAN ID: CVE-2008-1738 瑞星是中国的一家非常著名的杀毒软件厂商。 瑞星的驱动实现上存在漏洞，本地攻击者可能利用此漏洞导致系统崩溃。 瑞星杀毒软件的NtOpenProcess钩子没有验证以下结构的指针： /----------- typedef struct CLIENTID HANDLE UniqueProcess; HANDLE UniqueThread; - -----------/ 是否指向了所映射的内存，当代码试图引用指针检查CLIENTID-UniqueProcess值时，如果指向了无效的内存，系统就会崩溃。...

CVE-2008-1738

CVE-2008-1738 is a kernel‑mode vulnerability involving insufficient argument validation of hooked SSDT functions in multiple antivirus products. The CoreLabs CORE-2008-0320 advisory documents an invalid memory reference vulnerability that can cause local DoS (system crash) and, in some cases, may...