ByteOS Network

Vulnerability Details :

CVE-2009-3523

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-01 Oct, 2009 | 16:00

Updated At-07 Aug, 2024 | 06:31

aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034, which allows local users to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption, a different vulnerability than CVE-2008-1625.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:01 Oct, 2009 | 16:00

Updated At:07 Aug, 2024 | 06:31

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://www.ntinternals.org/ntiadv0904/ntiadv0904.html	x_refsource_MISC
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6024	vdb-entry signature x_refsource_OVAL
http://secunia.com/advisories/36858	third-party-advisory x_refsource_SECUNIA
http://www.avast.com/eng/avast-4-home_pro-revision-history.html	x_refsource_CONFIRM

Hyperlink: http://www.ntinternals.org/ntiadv0904/ntiadv0904.html

Resource:

x_refsource_MISC

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6024

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: http://secunia.com/advisories/36858

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://www.avast.com/eng/avast-4-home_pro-revision-history.html

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.ntinternals.org/ntiadv0904/ntiadv0904.html	x_refsource_MISC x_transferred
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6024	vdb-entry signature x_refsource_OVAL x_transferred
http://secunia.com/advisories/36858	third-party-advisory x_refsource_SECUNIA x_transferred
http://www.avast.com/eng/avast-4-home_pro-revision-history.html	x_refsource_CONFIRM x_transferred

Hyperlink: http://www.ntinternals.org/ntiadv0904/ntiadv0904.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6024

Resource:

vdb-entry

signature

x_refsource_OVAL

x_transferred

Hyperlink: http://secunia.com/advisories/36858

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://www.avast.com/eng/avast-4-home_pro-revision-history.html

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:01 Oct, 2009 | 17:00

Updated At:19 Sep, 2017 | 01:29

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 2.0

Base score: 6.9

Base severity: MEDIUM

Vector:

AV:L/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

avast>>avast_antivirus_home>>Versions up to 4.8.1351(inclusive)

cpe:2.3:a:avast:avast_antivirus_home:*:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.7.827

cpe:2.3:a:avast:avast_antivirus_home:4.7.827:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.7.844

cpe:2.3:a:avast:avast_antivirus_home:4.7.844:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.7.869

cpe:2.3:a:avast:avast_antivirus_home:4.7.869:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.7.1043

cpe:2.3:a:avast:avast_antivirus_home:4.7.1043:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.7.1098

cpe:2.3:a:avast:avast_antivirus_home:4.7.1098:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.8.1169

cpe:2.3:a:avast:avast_antivirus_home:4.8.1169:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.8.1195

cpe:2.3:a:avast:avast_antivirus_home:4.8.1195:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.8.1201

cpe:2.3:a:avast:avast_antivirus_home:4.8.1201:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.8.1227

cpe:2.3:a:avast:avast_antivirus_home:4.8.1227:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.8.1229

cpe:2.3:a:avast:avast_antivirus_home:4.8.1229:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.8.1282

cpe:2.3:a:avast:avast_antivirus_home:4.8.1282:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.8.1290

cpe:2.3:a:avast:avast_antivirus_home:4.8.1290:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.8.1296

cpe:2.3:a:avast:avast_antivirus_home:4.8.1296:*:windows:*:*:*:*:*

avast>>avast_antivirus_home>>4.8.1335

cpe:2.3:a:avast:avast_antivirus_home:4.8.1335:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>Versions up to 4.8.1351(inclusive)

cpe:2.3:a:avast:avast_antivirus_professional:*:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.7.827

cpe:2.3:a:avast:avast_antivirus_professional:4.7.827:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.7.844

cpe:2.3:a:avast:avast_antivirus_professional:4.7.844:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.7.1043

cpe:2.3:a:avast:avast_antivirus_professional:4.7.1043:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.7.1098

cpe:2.3:a:avast:avast_antivirus_professional:4.7.1098:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.8.1169

cpe:2.3:a:avast:avast_antivirus_professional:4.8.1169:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.8.1195

cpe:2.3:a:avast:avast_antivirus_professional:4.8.1195:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.8.1201

cpe:2.3:a:avast:avast_antivirus_professional:4.8.1201:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.8.1227

cpe:2.3:a:avast:avast_antivirus_professional:4.8.1227:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.8.1229

cpe:2.3:a:avast:avast_antivirus_professional:4.8.1229:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.8.1282

cpe:2.3:a:avast:avast_antivirus_professional:4.8.1282:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.8.1290

cpe:2.3:a:avast:avast_antivirus_professional:4.8.1290:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.8.1296

cpe:2.3:a:avast:avast_antivirus_professional:4.8.1296:*:windows:*:*:*:*:*

avast>>avast_antivirus_professional>>4.8.1335

cpe:2.3:a:avast:avast_antivirus_professional:4.8.1335:*:windows:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	nvd@nist.gov

CWE ID: CWE-20

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://secunia.com/advisories/36858	cve@mitre.org	Vendor Advisory
http://www.avast.com/eng/avast-4-home_pro-revision-history.html	cve@mitre.org	N/A
http://www.ntinternals.org/ntiadv0904/ntiadv0904.html	cve@mitre.org	Exploit
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6024	cve@mitre.org	N/A

Hyperlink: http://secunia.com/advisories/36858

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: http://www.avast.com/eng/avast-4-home_pro-revision-history.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.ntinternals.org/ntiadv0904/ntiadv0904.html

Source: cve@mitre.org

Resource:

Exploit

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6024

Source: cve@mitre.org

Resource: N/A

Similar CVEs

55Records found

CVE-2018-0868

Matching Score-4

Assigner-Microsoft Corporation

View Details

Matching Score-4

Assigner-Microsoft Corporation

CVSS Score-7||HIGH

EPSS-0.62% / 69.16%

7 Day CHG~0.00%

Published-14 Mar, 2018 | 17:00

Updated-16 Sep, 2024 | 16:48

Windows Installer in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to how input is sanitized, aka "Windows Installer Elevation of Privilege Vulnerability".

Vendor-Microsoft Corporation

Product-windows_server_2016 windows_server_2012 windows_8.1 windows_rt_8.1 windows_7 windows_10 windows_server_2008 Windows Installer

CWE ID-CWE-20

Improper Input Validation

CVE-2017-8714

Matching Score-4

Assigner-Microsoft Corporation

View Details

Matching Score-4

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-1.06% / 76.70%

7 Day CHG~0.00%

Published-13 Sep, 2017 | 01:00

Updated-20 Apr, 2025 | 01:37

The Windows Hyper-V component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2,, Windows 10 1607, and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka "Remote Desktop Virtual Host Remote Code Execution Vulnerability".

Vendor-Microsoft Corporation

Product-windows_server_2012 windows_8.1 windows_10 windows_server_2016 Windows Hyper-V

CWE ID-CWE-20

Improper Input Validation

CVE-2011-2022

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.9||MEDIUM

EPSS-0.04% / 12.09%

7 Day CHG~0.00%

Published-09 May, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

The agp_generic_remove_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 does not validate a certain start parameter, which allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_UNBIND agp_ioctl ioctl call, a different vulnerability than CVE-2011-1745.

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.

Product-linux_kernel enterprise_linux enterprise_linux_workstation enterprise_linux_server enterprise_linux_desktop enterprise_linux_aus enterprise_linux_eus n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2016-1570

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.5||HIGH

EPSS-0.20% / 42.69%

7 Day CHG~0.00%

Published-22 Jan, 2016 | 15:00

Updated-12 Apr, 2025 | 10:46

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.

Vendor-n/a Xen Project

Product-xen n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2016-9093

Matching Score-4

Assigner-Symantec - A Division of Broadcom

View Details

Matching Score-4

Assigner-Symantec - A Division of Broadcom

CVSS Score-7||HIGH

EPSS-0.09% / 26.77%

7 Day CHG~0.00%

Published-16 Apr, 2018 | 18:00

Updated-16 Sep, 2024 | 21:58

A version of the SymEvent Driver that shipped with Symantec Endpoint Protection 12.1 RU6 MP6 and earlier fails to properly sanitize logged-in user input. SEP 14.0 and later are not impacted by this issue. A non-admin user would need to be able to save an executable file to disk and then be able to successfully run that file. If properly constructed, the file could access the driver interface and potentially manipulate certain system calls. On all 32-bit systems and in most cases on 64-bit systems, this will result in a denial of service that will crash the system. In very narrow circumstances, and on 64-bit systems only, this could allow the user to run arbitrary code on the local machine with kernel-level privileges. This could result in a non-privileged user gaining privileged access on the local machine.

Vendor-Symantec Corporation

Product-endpoint_protection Endpoint Protection

CWE ID-CWE-20

Improper Input Validation

CVE-2009-3523

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs