6.9

CVE-2014-4973

Exploit
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in ESET Smart Security and ESET Endpoint Security products 5.0 through 7.0 allows local users to gain privileges via a crafted argument to a 0x830020CC IOCTL call.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Eset ≫ Smart Security Version 5.0.94
Eset ≫ Smart Security Version 5.0.95
Eset ≫ Smart Security Version 5.2.9
Eset ≫ Smart Security Version 5.2.15
Eset ≫ Smart Security Version 6.0.306
Eset ≫ Smart Security Version 6.0.308
Eset ≫ Smart Security Version 6.0.314
Eset ≫ Smart Security Version 6.0.316
Eset ≫ Endpoint Security Version 5.0.2113
Eset ≫ Endpoint Security Version 5.0.2122
Eset ≫ Endpoint Security Version 5.0.2126
Eset ≫ Endpoint Security Version 5.0.2214
Eset ≫ Endpoint Security Version 5.0.2225
Eset ≫ Endpoint Security Version 5.0.2228
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.31% 0.669
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://seclists.org/fulldisclosure/2014/Aug/52
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-4973/
Exploit