Escalated Privileges in WinPcap

Security service iDefense has reported a vulnerability in WinPcap which allows local users to escalate their privileges. WinPcap provides drivers that applications can use to record network packets. The bug resides in the driver npf.sys. This incorrectly checks parameters passed to IOCTL 9031 (BIOCGSTATS) when processing an interrupt request packet (IRP), allowing attackers to use manipulated requests to overwrite kernel memory and cause their own program code to run.

The bug is in version 4.0.0.755 of npf.sys and possibly prior versions. This version is installed, for example, when installing the version of WinPcap which is included in Wireshark 0.99.5. The current version of WinPcap, 4.0.1, closes the security hole and users should install it without delay.

See also:

• WinPcap NPF.SYS Local Privilege Escalation Vulnerability, security alert from iDefense
• Download from WinPcap

(mba)