CVE-2016-4305: kaspersky internet_security Improper Access Control

Vulnerability summary

CVE-2016-4305 is a medium (CVSS 5.5) Improper Access Control vulnerability in kaspersky internet_security. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-01-2017
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call can cause a access violation in KLIF kernel driver resulting in local denial of service. An attacker can run program from user-mode to trigger this vulnerability.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.