Elaborate Bytes ElbyCDIO.sys 6.0.2.0 and previous versions, as distributed in SlySoft AnyDVD prior to 6.5.2.6, Virtual CloneDrive 5.4.2.3 and previous versions, CloneDVD 2.9.2.0 and previous versions, and CloneCD 5.3.1.3 and previous versions, uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to cause a denial of service (system crash) via a crafted IOCTL call.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
slysoft anydvd |
||
slysoft virtualclonedrive |
||
slysoft clonedvd |
||
slysoft clonecd |
While analysing an incident which involved a suspected keylogger, we identified a malicious library able to interact with a virtual file system, which is usually the sign of an advanced APT actor. This turned out to be a malicious loader internally named ‘Slingshot’, part of a new, and highly sophisticated attack platform that rivals Project Sauron and Regin in complexity. The initial loader replaces the victim´s legitimate Windows library ‘scesrv.dll’ with a malicious one of exactly th...
Vulmon