bugtraq - [48bits] Advisory : Multiple vulnerabilities in Norman NVC 5.82 driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 31 Aug 2007 00:07:34 +0200
From: "vulndev 48bits" <vulndev@...its.com>
To: bugtraq@...urityfocus.com
Subject: [48bits] Advisory : Multiple vulnerabilities in Norman NVC 5.82 driver

Abstract:

There are multiple bugs in nvcoaft51 driver from Norman products.
These bugs could be locally exploited by a malicious user in order
to gain unlimited access to the system.

Nvcoaft51 driver creates a device named NvcOa without a restrictive
security descriptor, so any user can open it and send control codes
directly to the device driver. Arbitrary code execution at kernel mode
is possible because the code that manages IOCTL's is not bug free.

Detailed information and proof of concept exploit code of a tricky
kernel pool overflow can be downloaded here :

http://www.48bits.com/exploits/nvc.rar

Cheers,

InocraM  –  inocram[at]48bits[dot]com
[48Bits I+D Team]