CVE-2007-5667

EPSS 0.04%
Veröffentlicht 14.11.2007 01:46:00
Zuletzt bearbeitet 09.04.2025 00:30:58
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

NWFILTER.SYS in Novell Client 4.91 SP 1 through SP 4 for Windows 2000, XP, and Server 2003 makes the \.\nwfilter device available for arbitrary user-mode input via METHOD_NEITHER IOCTLs, which allows local users to gain privileges by passing a kernel address as an argument and overwriting kernel memory locations.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 11

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Novell ≫ Client Version4.91 Updatesp1

   Microsoft ≫ Windows 2000 Editionadv_srv
   Microsoft ≫ Windows 2000 Editiondatacenter_srv
   Microsoft ≫ Windows 2000 Editionpro
   Microsoft ≫ Windows 2000 Editionsrv
   Microsoft ≫ Windows 2000 Editionsrv Langja
   Microsoft ≫ Windows 2000 Version-
   Microsoft ≫ Windows 2003 Server Editionitanium
   Microsoft ≫ Windows 2003 Server Editionstd
   Microsoft ≫ Windows 2003 Server Editionwed
   Microsoft ≫ Windows 2003 Server Editionx64
   Microsoft ≫ Windows 2003 Server Editionx64-std
   Microsoft ≫ Windows 2003 Server Editionxp-64bit
   Microsoft ≫ Windows 2003 Server Version-
   Microsoft ≫ Windows Server 2003
   Microsoft ≫ Windows Xp Edition64bit
   Microsoft ≫ Windows Xp Editionembedded
   Microsoft ≫ Windows Xp Editionibm_oem
   Microsoft ≫ Windows Xp Editionmedia_center
   Microsoft ≫ Windows Xp Editionpro
   Microsoft ≫ Windows Xp Editiontablet_pc
   Microsoft ≫ Windows Xp Editionx64
   Microsoft ≫ Windows Xp Version-

Novell ≫ Client Version4.91 Updatesp2

Novell ≫ Client Version4.91 Updatesp3

Novell ≫ Client Version4.91 Updatesp4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.04%	0.091

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.2	3.9	10	AV:L/AC:L/Au:N/C:C/I:C/A:C

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=626

http://osvdb.org/40867

http://secunia.com/advisories/27678

Patch

Vendor Advisory

http://www.securityfocus.com/bid/26420

http://www.securitytracker.com/id?1018943

http://www.vupen.com/english/advisories/2007/3846

https://exchange.xforce.ibmcloud.com/vulnerabilities/38434

https://secure-support.novell.com/KanisaPlatform/Publishing/98/3260263_f.SAL_Public.html

Patch

https://nvd.nist.gov/vuln/detail/CVE-2007-5667

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2007-5667

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2007-5667

EUVD