>> Symantec Gear Device Driver Local Privilege Escalation Vulnerability
Title : Symantec Gear Device Driver Local Privilege Escalation Vulnerability VUPEN ID : VUPEN/ADV-2008-2770 CVE ID : CVE-2008-3636 CWE ID : CWE-189
Rated as : Moderate Risk
Remotely Exploitable : No Locally Exploitable : Yes Release Date : 2008-10-09
Technical Description
A vulnerability has been identified in various Symantec products, which could potentially be exploited by local attackers to gain elevated privileges. This issue is caused by an input validation error in the third-party driver "GEARspiWDM.sys" when processing data from user-space applications, which could allow malicious users to make multiple calls to "IoAttachDevice" and trigger an integer overflow in Windows kernel, leading to arbitrary code execution with SYSTEM privileges. For additional information, see : VUPEN/ADV-2008-2769
Upgrade the affected driver via LiveUpdate (for Symantec Norton 360) and via Gear Software's web site (for other impacted products) : http://www.gearsoftware.com/support/drivers.cfm References
