CVE-2017-18019

Description

In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be used to compare an arbitrary memory address with a fixed value, which in turn can be used to read the contents of arbitrary memory. Similarly, the product crashes upon a \.\K7Sentry DeviceIoControl call with an invalid kernel pointer.

CVSS Version 3.0

nvd

CVE ID: CVE-2017-18019
Base Score: 7.1
Base Severity: HIGH
Vector String:CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CVSS Version 2.0

nvd

CVE ID: CVE-2017-18019
Base Score: 3.6
Base Severity: LOW
Vector String:AV:L/AC:L/Au:N/C:P/I:N/A:P

Proof Of Concept

SpiralBL0CK

Under Construction :) Please come back later

Refrence: GitHub

Refrence: NVD