Vulnerabilty Update From Prior Post
Here is more detailed description:There are two so called vulnerabilities described in the article. First part mentions BSOD due to the lack of data checking in the internal driver requests. The code that was hacked is outdated and don’t needed for modern PCs. This code will be removed from the products in the nearest MPs.
Second part mentions lack in the self defense of the product. The product is protected from the DuplicateHandle routine for the processes but the author used DuplicateHandle for stopping the threads. There is a huge number of techniques allowing product stop. Most of AV vendors does not provide self defense at all. Kaspersky AV makes self-defense penetration as hard as possible. But we can’t close all the possibilities Windows provides. Closing DuplicateHandle for threads is resource-expensive but ineffective task. Driver in KAV 8.0 will be better defended.
