ID

VAR-201004-0514

TITLE

Rising Antivirus 2010 RsAssist.sys Driver Local Privilege Escalation Vulnerability

DESCRIPTION

Rising is a well-known anti-virus software vendor in China. The RsAssist.sys driver used by Rising Antivirus 2010 does not properly handle IOCTL requests, and local users can execute arbitrary kernel mode code by running malicious programs. Rising Antivirus 2010 is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to execute arbitrary code with superuser privileges and completely compromise the affected computer. Failed exploit attempts will result in a denial-of-service condition. The issue affects Rising Antivirus 2010 versions prior to 22.0.3.54. ---------------------------------------------------------------------- Secunia CSI + Microsoft SCCM ----------------------- = Extensive Patch Management http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ ---------------------------------------------------------------------- TITLE: Rising Antivirus 2010 RsAssist.sys Privilege Escalation Vulnerability SECUNIA ADVISORY ID: SA39557 VERIFY ADVISORY: http://secunia.com/advisories/39557/ DESCRIPTION: A vulnerability has been reported in Rising Antivirus 2010, which can be exploited by malicious, local users to potentially gain escalated privileges. The vulnerability is caused due to an error in the RsAssist.sys driver when handling IOCTLs. This can be exploited to potentially execute arbitrary code in kernel space via a specially crafted IOCTL. SOLUTION: Update to version 22.0.3.54 or later. PROVIDED AND/OR DISCOVERED BY: NT Internals ORIGINAL ADVISORY: NT Internals: http://www.ntinternals.org/ntiadv1001/ntiadv1001.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

IOT TAXONOMY

AFFECTED PRODUCTS

THREAT TYPE

local

TYPE

Design Error

EXTERNAL IDS

REFERENCES

CREDITS

NT Internals

SOURCES

LAST UPDATE DATE

2022-05-17T02:09:18.266000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE