CVE-2007-5633

Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, allows local users to read or write arbitrary MSRs, and gain privileges and load unsigned drivers, via the (1) IOCTL_RDMSR 0x9C402438 and (2) IOCTL_WRMSR 0x9C40243C IOCTLs to \Device\speedfan, as demonstrated by an IOCTL_WRMSR action on MSR_LSTAR.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.reversemode.com/index.php?option=com_content&task=view&id=42&Itemid=1
http://www.bugtrack.almico.com/view.php?id=987	Exploit
http://www.securityfocus.com/bid/26123	Exploit
http://secunia.com/advisories/27312
http://osvdb.org/41842
https://exchange.xforce.ibmcloud.com/vulnerabilities/37298

Advertisement

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*

cpe:2.3:a:almico:speedfan:4.33:*:*:*:*:*:*:*

Information

Published : 2007-10-23 10:46

Updated : 2017-07-28 18:33

NVD link : CVE-2007-5633

Mitre link : CVE-2007-5633

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

microsoft

windows_vista

almico

speedfan

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.reversemode.com/index.php?option=com_content&task=view&id=42&Itemid=1", "name": "http://www.reversemode.com/index.php?option=com_content&task=view&id=42&Itemid=1", "tags": [], "refsource": "MISC"}, {"url": "http://www.bugtrack.almico.com/view.php?id=987", "name": "http://www.bugtrack.almico.com/view.php?id=987", "tags": ["Exploit"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/26123", "name": "26123", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/27312", "name": "27312", "tags": [], "refsource": "SECUNIA"}, {"url": "http://osvdb.org/41842", "name": "41842", "tags": [], "refsource": "OSVDB"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37298", "name": "speedfan-ioctl-privilege-escalation(37298)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, allows local users to read or write arbitrary MSRs, and gain privileges and load unsigned drivers, via the (1) IOCTL_RDMSR 0x9C402438 and (2) IOCTL_WRMSR 0x9C40243C IOCTLs to \\Device\\speedfan, as demonstrated by an IOCTL_WRMSR action on MSR_LSTAR."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-5633", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": true, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2007-10-23T17:46Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:almico:speedfan:4.33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-29T01:33Z"}