Advisory Details

May 2nd, 2014

Kaspersky Internet Security prremote.dll Use-After-Free Remote Code Execution Vulnerability

CVE ID
CVSS SCORE	10.0, AV:N/AC:L/Au:N/C:C/I:C/A:C
AFFECTED VENDORS	Kaspersky
AFFECTED PRODUCTS	Internet Security
VULNERABILITY DETAILS	This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Kaspersky Internet Security. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists within the built-in RPC server implemented in prremote.dll. This RPC server listens over the 'PRRemote:' RPC endpoint. Through the RPC server an attacker can insert a specially crafted `call_table_ref` in order to gain code execution. An attacker can execute arbitrary code under the context of SYSTEM or the user of the process.
ADDITIONAL DETAILS	Kaspersky has issued an update to correct this vulnerability. More details can be found at: http://support.kaspersky.com/10235#block0
DISCLOSURE TIMELINE	2013-06-10 - Vulnerability reported to vendor 2014-05-02 - Coordinated public release of advisory
CREDIT	ZombiE

BACK TO ADVISORIES