CVE-2005-1905

Description

The klif.sys driver in Kaspersky Labs Anti-Virus 5.0.227, 5.0.228, and 5.0.335 on Windows 2000 allows local users to gain privileges by modifying certain critical code addresses that are later accessed by privileged programs.

Affected products

• Kaspersky Lab / kaspersky_anti-virus5.0.227 – 5.0.227
• Kaspersky Lab / kaspersky_anti-virus5.0.228 – 5.0.228
• Kaspersky Lab / kaspersky_anti-virus5.0.335 – 5.0.335
• Kaspersky Lab / kaspersky_anti-virus_personal5.0.227 – 5.0.227
• Kaspersky Lab / kaspersky_anti-virus_personal5.0.228 – 5.0.228
• Kaspersky Lab / kaspersky_anti-virus_personal5.0.325 – 5.0.325

Exploits & proofs of concept

• exploit-dbKaspersky AntiVirus - 'klif.sys' Local Privilege Escalationby Ilya Rabinovich

References

• MISChttp://www.securityfocus.com/bid/13878
• MAILING_LISThttp://marc.info/?l=bugtraq&m=111817777430401&w=2