Description
The (a) NAVENG (NAVENG.SYS) and (b) NAVEX15 (NAVEX15.SYS) device drivers 20061.3.0.12 and later, as used in Symantec AntiVirus and security products, allow local users to gain privileges by overwriting critical system addresses using a crafted Irp to the IOCTL functions (1) 0x222AD3, (2) 0x222AD7, and (3) 0x222ADB.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Symantec AntiVirus - IOCTL Kernel Privilege Escalation (1) EDB-28763 · local · Aug 26, 2006 · verified
- Symantec AntiVirus - IOCTL Kernel Privilege Escalation (2) EDB-28764 · local · Aug 26, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 1016996 vdb-entry
- 20061005 [Reversemode Advisory] Symantec Antivirus Engine Privilege Escalation mailing-list
- 1017001 vdb-entry
- http://www.symantec.com/avcenter/security/Content/2006.10.05a.html
- 1017000 vdb-entry
- 1016997 vdb-entry
- 1016995 vdb-entry
- ADV-2006-3928 vdb-entry
- 1016998 vdb-entry
- 20061005 Symantec AntiVirus IOCTL Kernel Privilege Escalation Vulnerability third-party-advisory
- 1016994 vdb-entry
- 22288 third-party-advisory
- 20360 vdb-entry
- 1016999 vdb-entry
- 1017002 vdb-entry
- 1690 third-party-advisory
- symantec-ioctl-privilege-escalation(29360) vdb-entry
- VU#946820 third-party-advisory