Description
The NDIS-TDI Hooking Engine, as used in the (1) KLICK (KLICK.SYS) and (2) KLIN (KLIN.SYS) device drivers 2.0.0.281 for in Kaspersky Labs Anti-Virus 6.0.0.303 and other Anti-Virus and Internet Security products, allows local users to execute arbitrary code via crafted Irp structure with invalid addresses in the 0x80052110 IOCTL.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Kaspersky Internet Security 6.0.0.303 - IOCTL KLICK Local Overflow / Local Privilege Escalation EDB-2676 · local · Oct 29, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20061020 [Reversemode Advisory] Kaspersky Anti-Virus Privilege Escalation mailing-list
- kaspersky-klinklick-privilege-escalation(29677) vdb-entry
- 29891 vdb-entry
- 20061020 Re: iDefense Security Advisory 10.19.06: Kaspersky Labs Anti-Virus IOCTL Local Privilege Escalation Vulnerability mailing-list
- http://www.kaspersky.com/technews?id=203038678
- 20061020 Kaspersky Labs Anti-Virus IOCTL Local Privilege Escalation Vulnerability third-party-advisory
- 22478 third-party-advisory
- 20635 vdb-entry
- 1017093 vdb-entry
- ADV-2006-4117 vdb-entry