Description
The nvcoaft51 driver in Norman Virus Control (NVC) 5.82 uses weak permissions (unrestricted write access) for the NvcOa device, which allows local users to gain privileges by (1) triggering a buffer overflow in a kernel pool via a string argument to ioctl 0xBF67201C; or by (2) sending a crafted KEVENT structure through ioctl 0xBF672028 to overwrite arbitrary memory locations.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Norman Virus Control - 'nvcoaft51.sys' ioctl BF672028 EDB-4345 · local · Aug 30, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20070830 [48bits] Advisory : Multiple vulnerabilities in Norman NVC 5.82 driver mailing-list
- 1018636 vdb-entry
- 25499 vdb-entry
- 3087 third-party-advisory
- norman-nvcoaft-privilege-escalation(36373) vdb-entry
- http://www.48bits.com/exploits/nvc.rar