Description
Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit this vulnerability to perform sensitive and privileged operations on the target system.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Symantec PC Tools Internet Security
*affected
References
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules ↗
- https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language ↗
- https://kb.cert.org/vuls/id/158530 ↗
- https://www.kb.cert.org/vuls/id/158530 ↗