News
Vigil@nce: Avast AV, denial of service via aswRdr.sys
November 2009 by Vigil@nce
A local attacker can use aswRdr.sys in order to do a denial of
service or execute privileged code.
– Severity: 2/4
– Consequences: denial of service of computer
– Provenance: user shell
– Means of attack: 1 attack
– Ability of attacker: technician (2/4)
– Confidence: confirmed by the editor (5/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Creation date: 18/11/2009
IMPACTED PRODUCTS
– Avast antivirus
DESCRIPTION OF THE VULNERABILITY
The Avast! Antivirus installs the aswRdr.sys kernel driver.
The IOCTL 0x80002024 of aswRdr.sys does not check the size of the
data structure provided as input. An attacker can therefore use a
long size in order to generate an overflow.
A local attacker can thus stop the system, or execute privileged
code.
CHARACTERISTICS
– Identifiers: VIGILANCE-VUL-9204
– Url: http://vigilance.fr/vulnerability/Avast-AV-denial-of-service-via-aswRdr-sys-9204
