CVE-2007-5762
Novell NetWare Client 4.91 SP4 - Local Privilege Escalation via NICM.SYS IOCTL
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-5762. PoCs published by sickness.
AI-analyzed exploit summary This exploit targets a privilege escalation vulnerability in Novell Client 4.91 SP3/4 by manipulating the HalDispatchTable to overwrite kernel memory and steal SYSTEM tokens. It uses a vulnerable IOCTL (0x00143B6B) to trigger the exploit and spawns a SYSTEM-level command shell.
Description
NICM.SYS driver 3.0.0.4, as used in Novell NetWare Client 4.91 SP4, allows local users to execute arbitrary code by opening the \\.\nicm device and providing crafted kernel addresses via IOCTLs with the METHOD_NEITHER buffering mode.
Exploits (1)
This exploit targets a privilege escalation vulnerability in Novell Client 4.91 SP3/4 by manipulating the HalDispatchTable to overwrite kernel memory and steal SYSTEM tokens. It uses a vulnerable IOCTL (0x00143B6B) to trigger the exploit and spawns a SYSTEM-level command shell.