CVE-2006-3074: Buffer Overflow
klif.sys in Kaspersky Internet Security 6.0 and 7.0, Kaspersky Anti-Virus (KAV) 6.0 and 7.0, KAV 6.0 for Windows Workstations, and KAV 6.0 for Windows Servers does not validate certain parameters to the (1) NtCreateKey, (2) NtCreateProcess, (3) NtCreateProcessEx, (4) NtCreateSection, (5) NtCreateSymbolicLinkObject, (6) NtCreateThread, (7) NtDeleteValueKey, (8) NtLoadKey2, (9) NtOpenKey, (10) NtOpenProcess, (11) NtOpenSection, and (12) NtQueryValueKey hooked system calls, which allows local users to cause a denial of service (reboot) via an invalid parameter, as demonstrated by the ClientId parameter to NtOpenProcess.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3074?
CVE-2006-3074 is rated as a high-severity vulnerability due to its potential to allow unauthorized access or control over the affected Kaspersky software.
How do I fix CVE-2006-3074?
To fix CVE-2006-3074, it is recommended to update to the latest version of Kaspersky Anti-Virus or Kaspersky Internet Security that addresses this vulnerability.
Which Kaspersky products are affected by CVE-2006-3074?
CVE-2006-3074 affects Kaspersky Anti-Virus 6.0 and 7.0, as well as Kaspersky Internet Security 6.0 and 7.0.
What types of attacks can exploit CVE-2006-3074?
CVE-2006-3074 can potentially be exploited through local privilege escalation, allowing attackers to gain unauthorized control over the affected systems.
Is my system at risk if I use Kaspersky Anti-Virus or Internet Security version 6.0 or 7.0?
Yes, if you are using Kaspersky Anti-Virus or Internet Security version 6.0 or 7.0, your system is at risk due to CVE-2006-3074 and should be updated immediately.