Cisco VPN Client IPSec Driver Local kernel system pool Corruption PoC

セキュリティ

Cisco VPN　Clientにローカルでシステムカーネルの不正にプールを利用する？脆弱性に関するPoCが出ています。

/* cpndrv-dos.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Cisco Systems VPN Client IPSec Driver local kernel system pool corruption POC
 * by mu-b - Sat 11 Jan 2008
 *
 * - Tested on: CVPNDRVA.sys 5.0.02.0090
 *
 * specifying an input buffer size less-than 8+31-bytes results in the
 * local kernel non-paged pool (METHOD_BUFFERED) being corrupted with
 * uninitialised (dangling) kernel stack memory via an inline memcpy.
 *
 * Compile: MinGW + -lntdll
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

screenshot