Lucene search

MitreCVE-2007-4648

HistoryAug 31, 2007 - 11:17 p.m.

CVE-2007-4648

2007-08-3123:17:00

CWE-119

mitre

web.nvd.nist.gov

cve

2007

4648

norman virus control

nvc

driver

weak permissions

local users

privileges

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.1

Confidence

High

EPSS

Percentile

5.2%

JSON

The nvcoaft51 driver in Norman Virus Control (NVC) 5.82 uses weak permissions (unrestricted write access) for the NvcOa device, which allows local users to gain privileges by (1) triggering a buffer overflow in a kernel pool via a string argument to ioctl 0xBF67201C; or by (2) sending a crafted KEVENT structure through ioctl 0xBF672028 to overwrite arbitrary memory locations.

Affected configurations

Nvd

Node

normannorman_virus_controlMatch5.82

VendorProductVersionCPE
normannorman_virus_control5.82cpe:2.3:a:norman:norman_virus_control:5.82:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
norman	norman_virus_control	5.82	cpe:2.3:a:norman:norman_virus_control:5.82:::::::*

References

securityreason.com/securityalert/3087

www.48bits.com/exploits/nvc.rar

www.securityfocus.com/archive/1/478224/100/0/threaded

www.securityfocus.com/bid/25499

www.securitytracker.com/id?1018636

exchange.xforce.ibmcloud.com/vulnerabilities/36373

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.1

Confidence

High

EPSS

Percentile

5.2%

JSON

Related for CVE-2007-4648