CVEvulnerability
CVE-2009-1824
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-05-29
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-20
Description
The ps_drv.sys kernel driver in ArcaBit ArcaVir 2009 Antivirus Protection 9.4.3201.9 and earlier, ArcaVir 2009 Internet Security 9.4.3202.9 and earlier, ArcaVir 2009 System Protection 9.4.3203.9 and earlier, and ArcaBit 2009 Home Protection 9.4.3204.9 and earlier, allows local users to gain privileges via crafted METHOD_NEITHER IOCTL requests to \Device\ps_drv containing arbitrary kernel addresses, as demonstrated using the (1) 0x2A7B802B and possibly (2) 0x2A7B8004 and (3) 0x2A7B802F IOCTLs.
Affected configurations
• arcabit arcavir 2009 antivirus protection (<= 9.4.3201.9)
• arcabit arcavir 2009 home protection (<= 9.4.3204.9)
• arcabit arcavir 2009 internet security (<= 9.4.3202.9)
• arcabit arcavir 2009 system protection (<= 9.4.3203.9)
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://ntinternals.org/ntiadv0814/PsDrv_Exp.zip Exploit
- http://ntinternals.org/ntiadv0814/ntiadv0814.html Exploit
- http://secunia.com/advisories/35260 Vendor Advisory
- http://www.securityfocus.com/bid/35100 Exploit
- http://www.vupen.com/english/advisories/2009/1428 Vendor Advisory
- https://www.exploit-db.com/exploits/8782 www.exploit-db.com
- http://ntinternals.org/ntiadv0814/PsDrv_Exp.zip Exploit
- http://ntinternals.org/ntiadv0814/ntiadv0814.html Exploit
- http://secunia.com/advisories/35260 Vendor Advisory
- http://www.securityfocus.com/bid/35100 Exploit
- http://www.vupen.com/english/advisories/2009/1428 Vendor Advisory
- https://www.exploit-db.com/exploits/8782 www.exploit-db.com