Secunia

EP_X0FF has reported some vulnerabilities in Kasperky Anti-Virus, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerabilities are caused due to errors within klif.sys when handling the parameters of hooked functions. These can be exploited to cause a DoS by calling "NtCreateKey()", "NtCreateProcess()", "NtCreateProcessEx()", "NtCreateSection()", "NtCreateSymbolicLinkObject()", "NtCreateThread()", "NtDeleteValueKey()", "NtLoadKey2()", "NtOpenKey()", "NtOpenProcess()", "NtOpenSection()", or "NtQueryValueKey()" with a specially crafted parameter.

The vulnerabilities reportedly affect the following products and versions for Windows NT, Windows 2000, Windows 2003 x86, and Windows XP x86 :
* Kaspersky Internet Security 6.0 / 7.0
* Kaspersky Anti-Virus 6.0 / 7.0
* Kaspersky Anti-Virus for Windows Workstations 6.0
* Kaspersky Anti-Virus 6.0 for Windows Servers

Solution
Apply updates.
Further details available in Customer Area

Provided and/or discovered by
EP_X0FF

Independently discovered by Matousec Transparent Security.

Changelog
Further details available in Customer Area

Original Advisory
Kaspersky:
http://www.kaspersky.com/technews?id=203038695
http://www.kaspersky.com/technews?id=203038702

rootkit.com:
http://www.rootkit.com/newsread.php?newsid=726

Matousec Transparent Security:
http://www.matousec.com/info/advisories/Kaspersky-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.php

Deep Links
Links available in Customer Area