===============================ADVISORY=============================== Advisory: Securstar - DriveCrypt - Local Kernel Denial of Service/Memory Disclosure/Privilege Escalation Advisory ID: DSEC-2011-0001 Author: Neil Kettle, Digit Security Ltd Affected Software: Securstar DriveCrypt Vendor URL: http://www.securstar.com Vendor Status: 'patched' Category: Denial of Service/Memory Disclosure/Privilege Escalation Date Reported: 2009/12/07 Last Modified: 2011/07/20 Release Date: 2011/07/20 ===============================ADVISORY=============================== Description ----------- Multiple vulnerabilities have been discovered in Securstar DriveCrypt kernel drivers, the vulnerabilities exist due to several somewhat systemic issues in the validation of user-supplied pointers and trust thereof, use of user-supplied parameters to privileged kernel functionality and finally, the lack of bounds checking in unbounded copy operations resulting in buffer overflows. Analysis -------- Numerous vulnerabilities exists due to a complete lack of validation of user- supplied pointers contained within structures passed as arguments to the IOCTL interface exported from the globally accessible "\\.\DCR" device. Exploitation ------------ An exploit will be made available to the public in due course at the following URL, http://www.digit-labs.org/ http://www.digit-security.com/research.php Technologies Affected ------------------------------ Securstar - DriveCrypt (<= 5.2) Vendor Response ------------------------------ http://www.securstar.com/press.php?id_press=405 Disclosure Timeline ------------------------------ 7th December 2009 - Vendor Disclosure 10th June 2011 - Vendor Releases Patches Credits ------------------------------ Neil Kettle of Digit Security Ltd About Digit Security Ltd ---------------------------------- Digit Security is a computer security consultancy based in the United Kingdom, albeit with a slight difference. The company is a co-operatively controlled entity comprised of professionals who are experts in their respective fields. Thus, as a corollary, nearly everyone at Digit Security is a both a Consultant, Developer and a Director. Web: www.digit-security.com Email: research@digit-security.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/