Ruben Santamarta has reported a vulnerability in multiple Kaspersky products, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or potentially gain escalated privileges.

The vulnerability is caused due to an error in the klim5.sys driver when handling IOCTL 0x80052110. This can be exploited to overwrite callback function pointers and execute arbitrary code with escalated privileges.

Solution
Restrict local access to trusted users only.

Provided and/or discovered by
Ruben Santamarta, Wintercore

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.wintercore.com/advisories/advisory_W020209.html

Deep Links
Links available to Secunia VIM customers