Description
NWFILTER.SYS in Novell Client 4.91 SP 1 through SP 4 for Windows 2000, XP, and Server 2003 makes the \.\nwfilter device available for arbitrary user-mode input via METHOD_NEITHER IOCTLs, which allows local users to gain privileges by passing a kernel address as an argument and overwriting kernel memory locations.
References
- 27678 third-party-advisory
- novell-client-nwfilter-privilege-escalation(38434) vdb-entry
- 1018943 vdb-entry
- https://secure-support.novell.com/KanisaPlatform/Publishing/98/3260263_f.SAL_Public.html
- ADV-2007-3846 vdb-entry
- 26420 vdb-entry
- 40867 vdb-entry
- 20071112 Novell NetWare Client NWFILTER.SYS Local Privilege Escalation Vulnerability third-party-advisory