CVE-2024-2204
Zemana
CVE-2024-2204 exposes Zemana AntiLogger to a Denial of Service (DoS) attack. This vulnerability in Zemana AntiLogger v2.74.204.664 can be triggered by sending specific IOCTL codes to the zam64.sys and zamguard64.sys drivers, specifically 0x80002004 and 0x80002010. Though the CVSS score is 0, indicating low immediate exploitability, the SVRS of 30 suggests potential for increased risk due to its presence "In The Wild". Attackers can leverage this vulnerability to crash the system, disrupting services and impacting user productivity. While not immediately critical, this vulnerability requires monitoring due to potential exploit development and increased attacker interest. Preventing this DoS requires patching the vulnerable drivers. The presence of this vulnerability "In The Wild" may indicate that threat actors are aware and actively targeting it.
Description
CVE-2024-2204 affects Zemana AntiLogger v2.74.204.664, a popular anti-malware software. This vulnerability allows attackers to trigger Denial of Service (DoS) conditions by exploiting the zam64.sys and zamguard64.sys drivers through specific IOCTL codes (0x80002004 and 0x80002010). Although the CVSS score is 5.5, SOCRadar's SVRS (Vulnerability Risk Score) assigns it a score of 30, indicating a moderate risk level.
Key Insights
- Exploitable via IOCTL: This vulnerability is exploitable by sending crafted requests to specific IOCTL codes within the vulnerable drivers. These codes are used for communication between the driver and the operating system.
- DoS Impact: Successful exploitation of this vulnerability can lead to a Denial of Service (DoS) attack, potentially disrupting the affected device's normal operation. This can be caused by resource exhaustion or system crashes.
- Active Exploitation: The CVE-2024-2204 vulnerability has been found "in the wild," meaning it is actively being exploited by attackers. This emphasizes the urgency of patching and mitigating the vulnerability.
- Limited Scope: The attack primarily targets the Zemana AntiLogger software. Users of other security products or systems may not be directly affected by this particular vulnerability.
Mitigation Strategies
- Software Updates: Immediately update Zemana AntiLogger to the latest version. This should include the necessary patch for CVE-2024-2204.
- Network Segmentation: Isolate the affected systems from the rest of the network to contain potential damage.
- Security Monitoring: Enhance security monitoring systems to detect any unusual activity related to Zemana AntiLogger or the vulnerable drivers.
- Whitelisting: Implement whitelisting policies to restrict the execution of untrusted applications and prevent malicious programs from exploiting this vulnerability.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.