[Reversemode Paper] Exploiting WDM Audio Drivers

[Reversemode <advisories () reversemode com>]

Hi,

For those researchers who are interested in the driver security and also 
for driver writers, the paper "Exploiting WDM Audio Drivers" has been 
released.

This paper explains an attack vector inherent to certain WDM audio 
drivers running on Windows Vista, XP, 2000 and 2003. Successful 
exploitation could lead to local escalation of privileges.

The paper also covers the interesting case of es1371mp.sys, a vulnerable 
WDM driver that can be automatically installed through Windows Update, 
on systems with Ensoniq PCI 1371 based SoundCards (Certain VMware 
products emulate a soundcard of this type).

It can be downloaded at :
(v 1.01) 
http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=54

Additionally, an exploit(es1371mp.sys)/Vuln-finder K-plugin for 
Kartoffel is available at :
http://kartoffel.reversemode.com/downloads.php


Regards,
-Ruben

---
www.reversemode.com