FYI…

- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1905
Description
The klif.sys driver in Kaspersky Labs Anti-Virus 5.0.227, 5.0.228, and 5.0.335 on Windows 2000 allows local users to gain privileges by modifying certain critical code addresses that are later accessed by privileged programs.

References
* BUGTRAQ: 20050607 Kaspersky AntiVirus "klif.sys" Privilege Escalation Vulnerability
* URL: http://marc.theaimsgroup.com/?l=bugtraq&m;=…17777430401&w;=2
* BID: 13878
* URL: http://www.securityfocus.com/bid/13878

- http://www.uscert.gov/cas/bulletins/SB05-159.html#Kaspersky
"…Kaspersky Anti-Virus for Microsoft Windows 2000, versions 5.0.227, 5.0.228, and 5.0.335…
…A Proof of Concept exploit has been published…"

:ph34r: