CVE-2007-5086

Severity Score

5.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Kaspersky Anti-Virus (KAV) and Internet Security 7.0 build 125 do not properly validate certain parameters to System Service Descriptor Table (SSDT) and Shadow SSDT function handlers, which allows local users to cause a denial of service (crash) via the (1) NtUserSendInput, (2) LoadLibraryA, (3) NtOpenProcess, (4) NtOpenThread, (5) NtTerminateProcess, (6) NtUserFindWindowEx, and (7) NtUserBuildHwndList kernel SSDT hooks in kylif.sys; the (8) NtDuplicateObject (DuplicateHandle) kernel SSDT hook; and possibly other kernel SSDT hooks. NOTE: the NtCreateSection vector is covered by CVE-2007-5043.1. NOTE: the vendor disputes that the DuplicateHandle vector is a vulnerability in their code, stating that "it is not an error in our code, but an obscure method for manipulating standard Windows routines to circumvent our self-defense mechanisms."

Kaspersky Anti-Virus (KAV) y Internet Security 7.0 construcción 125 no valida de forma adecuada ciertos parámetros en System Service Descriptor Table (SSDT) y manejadores de función Shadow SSDT, lo cual permite a usuarios locales provocar denegación de servicio (caida) a través de (1) NtUserSendInput, (2) LoadLibraryA, (3) NtOpenProcess, (4) NtOpenThread, (5) NtTerminateProcess, (6) NtUserFindWindowEx, y (7) NtUserBuildHwndList kernel SSDT enganchado en kylif.sys; el gancho(8) kernel NtDuplicateObject (DuplicateHandle) SSDT. NOTA: el vendededor cuestiona que el vector DuplicateHandle es una vulnerabilidad en su código, basándose en que "no es un error de nuestro código, pero un método oscuro para la manipulación estandar de las rutinas de windows sortea nuestros mecanismos de autodefensa".

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-09-25 CVE Reserved
2007-09-26 CVE Published
2024-08-07 CVE Updated
2024-08-07 First Exploit
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-20: Improper Input Validation

CAPEC

References (5)

URL	Tag	Source
http://osvdb.org/37990	Vdb Entry
http://www.kaspersky.com/technews?id=203038706	X_refsource_confirm
http://www.vupen.com/english/advisories/2007/3259	Vdb Entry

URL	Date	SRC
http://www.rootkit.com/newsread.php?newsid=778	2024-08-07

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/26887	2011-03-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Kaspersky Lab Search vendor "Kaspersky Lab"		Kaspersky Anti-virus Search vendor "Kaspersky Lab" for product "Kaspersky Anti-virus"				*		-		Affected
Kaspersky Lab Search vendor "Kaspersky Lab"		Kaspersky Internet Security Search vendor "Kaspersky Lab" for product "Kaspersky Internet Security"				7.0_build125 Search vendor "Kaspersky Lab" for product "Kaspersky Internet Security" and version "7.0_build125"		-		Affected