CVE-2018-6476: Input Validation
Published Jan 31, 2018
·Updated
In SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYSTEM because of not validating input values from IOCtl 0x9C402114 or 0x9C402124 or 0x9C40207c.
Affected Software
1 affected component
SUPERAntiSpyware SUPERAntiSpyware=6.0.1254
Event History
Jan 31, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·07:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-6476?
CVE-2018-6476 has been classified as a medium severity vulnerability due to its potential for privilege escalation.
2
How do I fix CVE-2018-6476?
To mitigate CVE-2018-6476, users should update to a patched version of SUPERAntiSpyware that addresses the vulnerability.
3
What systems are affected by CVE-2018-6476?
CVE-2018-6476 affects the SUPERAntiSpyware Professional version 6.0.1254.
4
What type of vulnerability is CVE-2018-6476?
CVE-2018-6476 is a privilege escalation vulnerability that allows unauthorized elevation of privileges to NT AUTHORITY\SYSTEM.
5
What input values are not validated in CVE-2018-6476?
CVE-2018-6476 involves unvalidated input values from IOCtl 0x9C402114, 0x9C402124, and 0x9C40207c.