Description
The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- WinPcap 4.0 - 'NPF.SYS' Local Privilege Escalation EDB-4165 · local · Jul 10, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 1018350 vdb-entry
- winpcap-npf-code-execution(35309) vdb-entry
- http://www.winpcap.org/misc/changelog.htm
- 4165 exploit
- 25982 third-party-advisory
- 37889 vdb-entry
- 20070709 WinPcap NPF.SYS Local Privilege Escalation Vulnerability third-party-advisory
- 24829 vdb-entry
- 20070709 WinPcap NPF.SYS Privilege Elevation Vulnerability mailing-list
- 20070710 Re: WinPcap NPF.SYS Privilege Elevation Vulnerability mailing-list
- 20070710 Re: Re: WinPcap NPF.SYS Privilege Elevation Vulnerability mailing-list
- ADV-2007-2468 vdb-entry