Vulnerability Details : CVE-2009-0824

Elaborate Bytes ElbyCDIO.sys 6.0.2.0 and earlier, as distributed in SlySoft AnyDVD before 6.5.2.6, Virtual CloneDrive 5.4.2.3 and earlier, CloneDVD 2.9.2.0 and earlier, and CloneCD 5.3.1.3 and earlier, uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to cause a denial of service (system crash) via a crafted IOCTL call.

Vulnerability category: OverflowDenial of service

Published 2009-03-14 18:30:01

Updated 2018-10-10 19:31:27

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2009-0824

Probability of exploitation activity in the next 30 days: 0.06%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 21 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2009-0824

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
4.9	MEDIUM	AV:L/AC:L/Au:N/C:N/I:N/A:C	3.9	6.9	nvd@nist.gov
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete

CWE ids for CVE-2009-0824

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-0824

Products affected by CVE-2009-0824

Slysoft » Virtualclonedrive
Versions up to, including, (<=) 5.4.2.3
cpe:2.3:a:slysoft:virtualclonedrive:*:*:*:*:*:*:*:*
Matching versions
Slysoft » Clonedvd
Versions up to, including, (<=) 2.9.2.0
cpe:2.3:a:slysoft:clonedvd:*:*:*:*:*:*:*:*
Matching versions
Slysoft » Clonecd
Versions up to, including, (<=) 5.3.1.3
cpe:2.3:a:slysoft:clonecd:*:*:*:*:*:*:*:*
Matching versions
Slysoft » Anydvd
Versions up to, including, (<=) 6.5.2.2
cpe:2.3:a:slysoft:anydvd:*:*:*:*:*:*:*:*
Matching versions