CVE-2009-4114: Input Validation
kl1.sys in Kaspersky Anti-Virus 2010 9.0.0.463, and possibly other versions before 9.0.0.736, does not properly validate input to IOCTL 0x0022c008, which allows local users to cause a denial of service (system crash) via IOCTL requests using crafted kernel addresses that trigger memory corruption, possibly related to klavemu.kdl.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4114?
CVE-2009-4114 has a moderate severity rating due to its potential to cause a denial of service through memory corruption.
How do I fix CVE-2009-4114?
To fix CVE-2009-4114, update Kaspersky Anti-Virus to version 9.0.0.736 or later.
What systems are affected by CVE-2009-4114?
CVE-2009-4114 affects Kaspersky Anti-Virus 2010 version 9.0.0.463 and potentially earlier versions.
What type of vulnerability is CVE-2009-4114?
CVE-2009-4114 is a memory corruption vulnerability that can lead to a system crash.
Can remote users exploit CVE-2009-4114?
CVE-2009-4114 is only exploitable by local users due to its nature of requiring crafted IOCTL requests.