bugtraq - [Reversemode Paper] Exploiting WDM Audio Drivers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 07 Jan 2008 16:30:26 +0100
From: Reversemode <advisories@...ersemode.com>
To: Securityfocus <bugtraq@...urityfocus.com>
Subject: [Reversemode Paper] Exploiting WDM Audio Drivers

Hi,

For those researchers who are interested in the driver security and also 
for driver writers, the paper "Exploiting WDM Audio Drivers" has been 
released.

This paper explains an attack vector inherent to certain WDM audio 
drivers running on Windows Vista, XP, 2000 and 2003. Successful 
exploitation could lead to local escalation of privileges.

The paper also covers the interesting case of es1371mp.sys, a vulnerable 
WDM driver that can be automatically installed through Windows Update, 
on systems with Ensoniq PCI 1371 based SoundCards (Certain VMware 
products emulate a soundcard of this type).

It can be downloaded at :
(v 1.01) 
http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=54

Additionally, an exploit(es1371mp.sys)/Vuln-finder K-plugin for 
Kartoffel is available at :
http://kartoffel.reversemode.com/downloads.php

Regards,
-Ruben

---
www.reversemode.com