KLA10946 Denial of service vulnerability in Kaspersky products

Vulnerability was found in the IOCTL handling functionality of Kaspersky Internet Security KL1 driver in Kaspersky products. By exploiting this vulnerability malicious users can cause an access violation and a denial of service as a result. This vulnerability can be exploited locally via a specialy designed IOCTL signal.

Technical details

Vulnerability can be exploited only in case machine already contains a malicious program.

Original advisories

Kaspersky Lab Advisory

Related products

Kaspersky-Internet-Security

Kaspersky-Anti-Virus

CVE list

CVE-2016-4307 warning

Solution

Install all updates for the products

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Affected Products

• Kaspersky Internet Security 2016 (16.0.0.614) Kaspersky Anti-Virus 2016 (16.0.0.614) Kaspersky Total Security 2016 (16.0.0.614)