CVE-2009-3523
Estado: ModificadaMedia (6.9)—
aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034, which allows local users to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption, a different vulnerability than CVE-2008-1625.
CVSS
- Versión: 2.0
- Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
- Puntuación base: 6.9
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.78%
- Percentil entre todas las CVEs puntuadas: 54
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-20
Referencias
- http://secunia.com/advisories/36858
- http://www.avast.com/eng/avast-4-home_pro-revision-history.html
- http://www.ntinternals.org/ntiadv0904/ntiadv0904.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6024
- http://secunia.com/advisories/36858
- http://www.avast.com/eng/avast-4-home_pro-revision-history.html
- http://www.ntinternals.org/ntiadv0904/ntiadv0904.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6024
JSON original (NVD)
Mostrar
{
"id": "CVE-2009-3523",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.9,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.4,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-10-01T17:00:00.267",
"references": [
{
"url": "http://secunia.com/advisories/36858",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.avast.com/eng/avast-4-home_pro-revision-history.html",
"source": "cve@mitre.org"
},
{
"url": "http://www.ntinternals.org/ntiadv0904/ntiadv0904.html",
"tags": [
"Exploit"
],
"source": "cve@mitre.org"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6024",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/36858",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.avast.com/eng/avast-4-home_pro-revision-history.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.ntinternals.org/ntiadv0904/ntiadv0904.html",
"tags": [
"Exploit"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6024",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034, which allows local users to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption, a different vulnerability than CVE-2008-1625."
},
{
"lang": "es",
"value": "aavmKer4.sys en avast! Home y Professional para Windows anterior v4.8.1356 no proporciona entradas validad en IOCTLs (1) 0xb2d6000c y (2) 0xb2d60034, que permite a usuarios locales obtener privilegios a través de peticiones IOCTL usando direcciones de kernel manipuladas que lanzan una caída de memoria, una vulnerabilidad diferente que CVE-2008-1625."
}
],
"lastModified": "2026-06-16T23:11:46.493",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:*:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C47AF58C-5BC9-40EC-98F6-48E1B645F4C6",
"versionEndIncluding": "4.8.1351"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.7.827:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33A71A2C-36AC-4F36-9D94-AA824F4DE14C"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.7.844:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "62618C12-3EAC-4434-B2A8-D83612F1A05C"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.7.869:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B949535B-9771-4AC6-BBDB-8BB3A789A1FA"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.7.1043:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC6DA89A-BF71-4031-9B51-E5941FDE5E15"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.7.1098:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB201D49-EB74-4A5D-B641-86C4429E3EC0"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.8.1169:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8C4E148-EAD0-433C-B0C3-3124B0288CC6"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.8.1195:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1867FC4C-01BC-4FA1-B33F-66CE7D4AD9B6"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.8.1201:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79057030-D57C-4DAC-B9F9-FE2CED222481"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.8.1227:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8CE03B00-0277-4738-8DA6-AFD09830B0DD"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.8.1229:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "921BC39F-E4EC-4B4C-BC7D-8002B7C3A85A"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.8.1282:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B03B958E-8FAA-48E4-BD0D-3577B7150284"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.8.1290:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36902F71-4215-40B5-93B5-75A5634D4501"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.8.1296:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F087F04-EF9C-43F0-95F0-36AD5182F02B"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_home:4.8.1335:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1757311C-A432-4056-A480-12713E4E0024"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:*:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C19547C-2369-4228-80CF-0A07735ED6AC",
"versionEndIncluding": "4.8.1351"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.7.827:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DF2D8C10-01E4-43D7-93EE-342BA7E9C489"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.7.844:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AAB7888A-E884-4C73-AF10-698C56E080F3"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.7.1043:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F7F2957-4422-4891-B573-F68882D7C8E1"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.7.1098:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC6DE028-27FD-40D7-AD12-F3C648B445E3"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.8.1169:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC35E740-8BE7-4479-B684-6E304204B358"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.8.1195:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "083372F2-D738-4698-97CF-F71748BE4877"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.8.1201:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38BAD92D-F9D8-4295-B9BD-FFB354937ED4"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.8.1227:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0348CFA9-6DC0-4FCE-B6B8-3D0D9086471F"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.8.1229:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "03B69989-B458-4624-B40F-37A7FCD11BA9"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.8.1282:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA7CEE2D-C92B-45A9-89F0-42A7DFAA7DD9"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.8.1290:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FDCB885F-8175-41B3-A6A6-1A9A3A239548"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.8.1296:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82039FC7-19D9-471C-A781-87D4CCE807CE"
},
{
"criteria": "cpe:2.3:a:avast:avast_antivirus_professional:4.8.1335:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6D8AF4B-27E2-4A7B-A474-AF453F6A22F3"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}