Some vulnerabilities have been reported in SiSoftware Sandra, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

The vulnerabilities are caused due to an errors in the sandra.sys kernel driver when processing IOCTLs. This can be exploited to corrupt kernel memory and execute arbitrary code in kernel space via a specially crafted IOCTL.

Successful exploitation requires that the driver has been loaded (e.g. by launching the application).

The vulnerabilities are reported in version 16.10.2010.1. Other versions may also be affected.

Solution
Grant only trusted users access to affected systems.
Further details available to Secunia VIM customers

Provided and/or discovered by
NT Internals

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.ntinternals.org/ntiadv0808/ntiadv0808.html

Deep Links
Links available to Secunia VIM customers