Advisory : Multiple vulnerabilities in Norman NVC 5.82 driver

Abstract:

There are multiple bugs in nvcoaft51 driver from Norman
products.
These bugs could be locally exploited by a malicious user in
order
to gain unlimited access to the system.

Nvcoaft51 driver creates a device named NvcOa without a
restrictive
security descriptor, so any user can open it and send
control codes
directly to the device driver. Arbitrary code execution at
kernel mode
is possible because the code that manages IOCTL's is not bug
free.

Detailed information and proof of concept exploit code of a
tricky
kernel pool overflow can be downloaded here :

http://www.48b
its.com/exploits/nvc.rar

Cheers,

InocraM  –  inocram[at]48bits[dot]com
[48Bits I+D Team]