PT-2009-05: CA Internet Security Suite Denial of Service Vulnerability
Internet Security Suite r3
Internet Security Suite r4 prior to 220.127.116.11
Internet Security Suite r5 prior to 10.0.0.217
Impact: Denial of Service
Attack Vector: Local
Base Score: 4.9
Positive Technologies Research Team has discovered a denial of service (DoS) vulnerability in CA Internet Security Suite.
The IOCTL handler in vetmonnt.sys does not properly validate buffer data associated with the Irp object, which allows local users to crash the system.
Install latest versions of Internet Security Suite through automatic update functionality.
CA Internet Security Suite r3 - upgrade to Internet Security Suite r5 and apply the latest updates
CA Internet Security Suite r4 - update your software to version 18.104.22.168
CA Internet Security Suite r5 - update your software to version 10.0.0.217
02/04/2009 - Vendor notified
02/04/2009 - Vendor response
02/04/2009 - Details sent
08/18/2009 - Vendor releases fixed version and details
08/25/2009 - Public disclosure
This vulnerability was discovered by Nikita Tarakanov, Positive Technologies Research Team.