Unscored severity · published Oct 20, 2006
CVE-2006-4926
The NDIS-TDI Hooking Engine, as used in the (1) KLICK (KLICK.SYS) and (2) KLIN (KLIN.SYS) device drivers 2.0.0.281 for in Kaspersky Labs Anti-Virus 6.0.0.303 and other Anti-Virus…
–
CVSS
1.3%
EPSS
No
On KEV
Description
The NDIS-TDI Hooking Engine, as used in the (1) KLICK (KLICK.SYS) and (2) KLIN (KLIN.SYS) device drivers 2.0.0.281 for in Kaspersky Labs Anti-Virus 6.0.0.303 and other Anti-Virus and Internet Security products, allows local users to execute arbitrary code via crafted Irp structure with invalid addresses in the 0x80052110 IOCTL.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KA
Kaspersky Anti-virus · Kaspersky Lab
5.0; 6.0 · source: NVD
KA
Kaspersky Anti-virus Personal · Kaspersky Lab
5.0 · source: NVD
KA
Kaspersky Anti-virus Personal Pro · Kaspersky Lab
5.0 · source: NVD
KI
Kaspersky Internet Security · Kaspersky Lab
6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4926
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4926
Patch
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=425
Patch
http://secunia.com/advisories/22478
Exploit
http://securitytracker.com/id?1017093
Patch
http://www.kaspersky.com/technews?id=203038678
Exploit
http://www.osvdb.org/29891
www.securityfocus.com
http://www.securityfocus.com/archive/1/449289/100/0/threaded
More from Kaspersky Anti-virus
–
CVE-2009-4452
Kaspersky Anti-Virus 5.0 (5.0.712); Antivirus Personal 5.0.x; Anti-Virus 6.0 (6.0.3.837), 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); and Internet Security 7 (7.0.1.325),…
–
CVE-2009-0449
Buffer overflow in klim5.sys in Kaspersky Anti-Virus for Workstations 6.0 and Anti-Virus 2008 allows local users to gain privileges via an IOCTL 0x80052110 call
–
CVE-2008-1518
Stack-based buffer overflow in kl1.sys in Kaspersky Anti-Virus 6.0 and 7.0 and Internet Security 6.0 and 7.0 allows local users to gain privileges via an IOCTL 0x800520e8 call
–
CVE-2007-5086
Kaspersky Anti-Virus (KAV) and Internet Security 7.0 build 125 do not properly validate certain parameters to System Service Descriptor Table (SSDT) and Shadow SSDT function…
–
CVE-2007-1112
Kaspersky Anti-Virus 6.0 and Internet Security 6.0 exposes unsafe methods in the (a) AXKLPROD60Lib.KAV60Info (AxKLProd60.dll) and (b) AXKLSYSINFOLib.SysInfo (AxKLSysInfo.dll)…