Description
vsdatant.sys 6.5.737.0 in Check Point Zone Labs ZoneAlarm before 7.0.362 allows local users to gain privileges via a crafted Interrupt Request Packet (Irp) in a METHOD_NEITHER (1) IOCTL 0x8400000F or (2) IOCTL 0x84000013 request, which can be used to overwrite arbitrary memory locations.
References
- 26513 third-party-advisory
- zonealarm-vsdatant-privilege-escalation(36107) vdb-entry
- ADV-2007-2929 vdb-entry
- 1018589 vdb-entry
- 25365 vdb-entry
- 20070820 Check Point Zone Labs VSDATANT Multiple IOCTL Privilege Escalation Vulnerabilities third-party-advisory
- 25377 vdb-entry
- 20070820 [Reversemode Advisory] CheckPoint ZoneLabs Vsdatant.sys multiple local privilege escalation vulnerabilities mailing-list
- http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=53