Kaspersky klif.sys denial of service
| kaspersky-klif-dos (27104) |  Medium Risk |
Description:
Kaspersky Anti-Virus and Kaspersky Internet Security are vulnerable to a denial of service caused by a memory access error in the klif.sys file. A local attacker could exploit this vulnerability to cause the system to reboot.
Consequences:
Denial of Service
Remedy:
Upgrade to the latest version of Kaspersky Anti-Virus, available via regular database update. See References.
References:
- Kaspersky Lab Web site: Kaspersky Antivirus Software Products for Home Computer Security.
- Uninformed Web site: Kaspersky Internet Security Suite 5.0.
- BID-18341: Kaspersky Internet Security Suite Multiple Local Vulnerabilities
- BID-24491: Kaspersky Internet Security 6 SSDT Hooks Multiple Local Vulnerabilities
- CVE-2006-3074: klif.sys in Kaspersky Internet Security 6.0 and 7.0, Kaspersky Anti-Virus (KAV) 6.0 and 7.0, KAV 6.0 for Windows Workstations, and KAV 6.0 for Windows Servers does not validate certain parameters to the (1) NtCreateKey, (2) NtCreateProcess, (3) NtCreateProcessEx, (4) NtCreateSection, (5) NtCreateSymbolicLinkObject, (6) NtCreateThread, (7) NtDeleteValueKey, (8) NtLoadKey2, (9) NtOpenKey, (10) NtOpenProcess, (11) NtOpenSection, and (12) NtQueryValueKey hooked system calls, which allows local users to cause a denial of service (reboot) via an invalid parameter, as demonstrated by the ClientId parameter to NtOpenProcess.
- SA20629: Kaspersky Anti-Virus "klif.sys" Denial of Service Vulnerability
- SA25603: Kaspersky AntiVirus klif.sys Hooked Functions Denial of Service
- SECTRACK ID: 1018257: Kaspersky Internet Security `klif.sys` Driver Lets Local Users Deny Service
- VUPEN/ADV-2006-2333: Kaspersky Anti-Virus klif.sys Pointer Validation Denial of Service Vulnerability
- VUPEN/ADV-2007-2145: Kaspersky Anti-Virus Products klif.sys Driver Local Denial of Service Vulnerability
Platforms Affected:
- Kaspersky Internet Security 6.0 and prior
- Kaspersky Internet Security Suite 5.0 and prior
- Kaspersky Kaspersky Anti-Virus 6.0 and prior
Reported:
Jun 14, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net