Vulnerability in Kaspersky Internet Security 2013

In the mailing list bugtraq Marc Heuse reported flaws in Kaspersky Internet Security 2013, which allows an attacker to remotely "freeze" the operating system on which the software is installed.

As conditions for the attack indicated the need to include the network stack ipv6 on the victim. Compiling the report accompanying software, you can check the availability of a remote vulnerability (utility firewall6).

According to the author, the essence of vulnerability is incorrect handling of network packets sent by the attacker, which consist of several packages vytavlennym flag fragmentation and one large packet header.



Furthermore, the author regrets that Kaspersky Lab that he sent a message about the vulnerability of January 21, 2013 (and again - 14 February) did not respond to this message and took no action to address the vulnerability. To address the vulnerability recommended that you remove all network interfaces Kaspersky Anti-Virus NDIS 6 Filter, error which lead to the existence of vulnerability, or remove KIS from your computer to resolve the vulnerability.

Bugtraq - Security Focus: http://www.securityfocus.com/archive/1/525884