Unscored severity · published Aug 25, 2012
CVE-2010-5157
Race condition in Comodo Internet Security before 4.1.149672.916 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would…
–
CVSS
0.4%
EPSS
No
On KEV
Description
Race condition in Comodo Internet Security before 4.1.149672.916 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Comodo Internet Security · Comodo
through 4.0.141842.828 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-5157
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-5157
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html
countermeasures.trendmicro.eu
http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/
forums.comodo.com
http://forums.comodo.com/news-announcements-feedback-cis/comodo-internet-security-41149672916-released-t57051.0.html
matousec.com
http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php
matousec.com
http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php
More from Comodo Internet Security
7.8
CVE-2019-18215
An issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0
–
CVE-2011-5123
The Antivirus component in Comodo Internet Security before 5.3.175888.1227 does not check whether X.509 certificates in signed executable files have been revoked, which has…
–
CVE-2011-5122
The Antivirus component in Comodo Internet Security before 5.3.175888.1227 allows remote attackers to cause a denial of service (application crash) via a crafted compressed file
–
CVE-2011-5121
The Antivirus component in Comodo Internet Security before 5.3.175888.1227 does not properly check whether unspecified X.509 certificates are revoked, which has unknown impact and…
–
CVE-2011-5120
The Antivirus component in Comodo Internet Security before 5.4.189822.1355 allows remote attackers to cause a denial of service (application crash) via a crafted .PST file