CVE-2009-4049

The CVE-2009-4049 entry concerns avast! AntiVirus for Windows (Home/Professional 4.8.1356.0) with a heap-based buffer overflow in the aswRdr.sys kernel driver (the TDI RDR driver). The underlying issue is a memory corruption condition triggered by crafted arguments sent to IOCTL 0x80002024, which...

Break through the firewall of the KillFilter-vulnerability warning-the black bar safety net

Alas, the software firewall seems like no one my satisfaction, are relatively weak, consider not all. The domestic firewall is chilling to either DLL injection or not introduction of DLL pure code injection, or TDI Cilent, the domestic firewall get. NDIS hook not to mention that the.. To the poin...

Computer Associates CA Internet Security / CA Personal Firewall privilege escalation

Insufficient TDI and NDIS hooked function paramters validation...

[Reversemode advisory] Computer Associates HIPS Drivers - multiple local privilege escalation vulnerabilities.

Computer Associates "Host Intrusion Prevention System" Engine Drivers are prone to multiple local privilege escalation vulnerabilities. Unprivileged users can take advantage of these flaws in order to execute arbitrary code with kernel privileges. Two drivers are affected, kmxstart.sys and...

[Reversemode Advisory] Kaspersky Anti-Virus Privilege Escalation

Hi, Kaspersky Products are prone to a local privilege escalation. Unprivileged users can exploit this flaw in order to execute arbitrary code with Kernel privileges. Kaspersky implements its NDIS-TDI Hooking Engine using two drivers, which rely on an internal system of plugins. Plugin registering...

CVE-2006-4926

The NDIS-TDI Hooking Engine, as used in the 1 KLICK KLICK.SYS and 2 KLIN KLIN.SYS device drivers 2.0.0.281 for in Kaspersky Labs Anti-Virus 6.0.0.303 and other Anti-Virus and Internet Security products, allows local users to execute arbitrary code via crafted Irp structure with invalid addresses ...

CVE-2006-4926

CVE-2006-4926 concerns a local privilege escalation in Kaspersky Anti-Virus 6.0.0.303 related to the NDIS-TDI Hooking Engine used by the KLICK.KILIN drivers (KLICK.SYS, KLIN.SYS) v2.0.0.281. Affected components process IOCTL 0x80052110 and an invalid address in crafted IRP structures, enabling lo...