{"vuid":"VU#946820","idnumber":"946820","name":"Symantec products fail to properly limit device driver access to kernel memory","keywords":["Symantec","privilege escalation","address space","IOCTL handlers","NAVEX15.SYS","NAVENG.SYS"],"overview":"Certain device drivers included with Symantec products fail to properly verify address space within the \"IOCTL\" handlers.","clean_desc":"Symantec provides Anti-Virus and Internet Security products that are designed to protect users. According to Symantec Security Response SYM06-020: A specially crafted IRP could be sent to the IOCTL handler function which could allow memory to be overwritten because the address space was not properly validated. The device drivers NAVENG and NAVEX15 improperly validate address space when processing IOCTL 0x222AD3, 0x222AD7, and 0x222ADB. A specially crafted I/O request packet (IRP) to the IOCTL handler function could overwrite a user supplied address with a constant double word value. Note that this vulnerability only affects the Symantec and Norton anti-virus products for Windows NT, Windows 2000, and Windows XP.","impact":"This vulnerability could allow a local attacker to execute arbitrary code with kernel level privileges.","resolution":"Update\nSymantec has addressed this issue with new virus definitions as specified in Symantec Security Response SYM06-020.","workarounds":"","sysaffected":"","thanks":"This issue was reported in \nSymantec Security Response \nSYM06-020 Symantec credits \nRuben Santamarta working with the iDefense Vulnerability Contributor Program for reporting this issue.","author":"This document was written by Chris Taschner.","public":["http://securityresponse.symantec.com/avcenter/security/Content/2006.10.05a.html","http://www.idefense.com/intelligence/vulnerabilities/display.php?id=417"],"cveids":["CVE-2006-4927"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-10-09T13:58:25Z","publicdate":"2006-10-06T00:00:00Z","datefirstpublished":"2006-10-10T13:24:38Z","dateupdated":"2006-10-11T14:10:01Z","revision":12,"vrda_d1_directreport":"0","vrda_d1_population":"2","vrda_d1_impact":"2","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"4","cam_population":"14","cam_impact":"20","cam_easeofexploitation":"4","cam_attackeraccessrequired":"10","cam_scorecurrent":"3.99","cam_scorecurrentwidelyknown":"5.04","cam_scorecurrentwidelyknownexploited":"9.24","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":3.99,"vulnote":null}