CVE-2007-5043 in Internet Security
Summary
by MITRE
Kaspersky Internet Security 7.0.0.125 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to (1) cause a denial of service (crash) and possibly gain privileges via the NtCreateSection kernel SSDT hook or (2) cause a denial of service (avp.exe service outage) via the NtLoadDriver kernel SSDT hook. NOTE: this issue may partially overlap CVE-2006-3074.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/01/2017
The vulnerability described in CVE-2007-5043 represents a critical security flaw in Kaspersky Internet Security 7.0.0.125 that stems from improper validation of parameters within System Service Descriptor Table (SSDT) function handlers. This issue occurs at the kernel level where the security software fails to adequately verify input parameters passed to critical system service handlers, creating potential attack vectors for local adversaries. The flaw specifically affects two primary SSDT hooks: NtCreateSection and NtLoadDriver, both of which are fundamental Windows kernel functions used for memory management and driver loading operations respectively. The vulnerability demonstrates a clear failure in input validation mechanisms that should normally be enforced at the kernel level to prevent malicious parameter manipulation.
The technical exploitation of this vulnerability manifests through two distinct attack vectors that leverage the improper parameter validation within SSDT handlers. The first vector allows local users to potentially cause system crashes and achieve privilege escalation through the NtCreateSection kernel SSDT hook, which is responsible for creating memory-mapped sections within the kernel address space. The second vector targets the NtLoadDriver kernel SSDT hook, enabling local attackers to cause service outages specifically affecting the avp.exe process, which is Kaspersky's core antivirus protection service. Both attack vectors exploit the same underlying root cause of insufficient parameter validation, making this vulnerability particularly concerning as it affects multiple kernel-level operations within the security software's architecture. This vulnerability directly relates to CWE-20, which addresses "Improper Input Validation" in software systems, and demonstrates how inadequate validation at critical kernel interfaces can lead to severe security consequences.
The operational impact of this vulnerability extends beyond simple system instability to potentially compromise the entire security posture of systems running the affected Kaspersky version. When local users can trigger denial of service conditions through kernel-level hooks, they effectively disrupt the security software's ability to protect the system, creating windows of vulnerability where malicious actors could exploit the service outages. The potential for privilege escalation through the NtCreateSection hook represents a particularly severe concern as it could allow attackers to gain elevated system privileges and bypass security controls entirely. The avp.exe service outage specifically undermines the core antivirus protection mechanism, leaving systems exposed to malware and other threats during the period when the security service is unavailable. This vulnerability aligns with ATT&CK technique T1055 for privilege escalation and T1489 for denial of service, demonstrating how kernel-level flaws can be leveraged to achieve both system compromise and service disruption.
The exploitation of this vulnerability requires local system access and demonstrates the principle of least privilege violation in security software design. Security products like Kaspersky Internet Security are expected to maintain robust parameter validation even when operating in kernel mode, as they handle critical system functions that could be leveraged for privilege escalation. The fact that this vulnerability exists in a widely deployed security product indicates a fundamental flaw in the software's architecture that affects its ability to properly secure the system it is designed to protect. Organizations running Kaspersky Internet Security 7.0.0.125 should immediately implement mitigation strategies including patching to newer versions that address the SSDT parameter validation issues, monitoring for unusual system behavior that might indicate exploitation attempts, and ensuring proper access controls to limit local user privileges where possible. The vulnerability serves as a reminder of the critical importance of secure kernel programming practices and the necessity of thorough validation of all inputs to system-level functions, particularly those that can affect privilege levels or system stability.