{"id":"CVE-2009-2450","aliases":["EUVD-2009-2445","GHSA-66r2-9m7r-3cvc"],"status":"published","title":"The OAmon.sys kernel driver 3.1.0.0 and earlier in Tall Emu Online Armor Personal Firewall AV+...","description":"The OAmon.sys kernel driver 3.1.0.0 and earlier in Tall Emu Online Armor Personal Firewall AV+ before 3.5.0.12, and Personal Firewall 3.5 before 3.5.0.14, allows local users to gain privileges via crafted METHOD_NEITHER IOCTL requests to \\Device\\OAmon containing arbitrary kernel addresses, as demonstrated using the 0x830020C3 IOCTL.","severity":{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00767,"percentile":0.55754,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-119"],"published":"2009-07-13T17:00:00Z","modified":"2026-06-16T23:09:28Z","exploits":[{"source":"exploitdb","id":"EDB-8875","title":"Online Armor \u003c 3.5.0.12 - 'OAmon.sys' Local Privilege Escalation","type":"local","platform":"windows","date":"2009-06-04","verified":true,"url":"https://www.exploit-db.com/exploits/8875"}],"products":[{"vendor":"tallemu","product":"online_armor_personal_firewall_av\\+"},{"vendor":"tallemu","product":"personal_firewall"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50960","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.securityfocus.com/bid/35227","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit"]},{"url":"http://www.exploit-db.com/exploits/8875","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://milw0rm.com/sploits/2009-OAmon_Exp.zip","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.ntinternals.org/ntiadv0806/ntiadv0806.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2450"},{"url":"https://github.com/advisories/GHSA-66r2-9m7r-3cvc"}],"sources":{"cve":[{"id":"CVE-2009-2450","description":"The OAmon.sys kernel driver 3.1.0.0 and earlier in Tall Emu Online Armor Personal Firewall AV+ before 3.5.0.12, and Personal Firewall 3.5 before 3.5.0.14, allows local users to gain privileges via crafted METHOD_NEITHER IOCTL requests to \\Device\\OAmon containing arbitrary kernel addresses, as demonstrated using the 0x830020C3 IOCTL.","status":"published","published":"2009-07-13T17:00:00Z","modified":"2024-08-07T05:52:14.807Z","updated_at":"2026-11-02T14:33:23.395558Z"}],"euvd":[{"id":"EUVD-2009-2445","description":"The OAmon.sys kernel driver 3.1.0.0 and earlier in Tall Emu Online Armor Personal Firewall AV+ before 3.5.0.12, and Personal Firewall 3.5 before 3.5.0.14, allows local users to gain privileges via crafted METHOD_NEITHER IOCTL requests to \\Device\\OAmon containing arbitrary kernel addresses, as demonstrated using the 0x830020C3 IOCTL.","status":"published","published":"2009-07-13T17:00:00Z","modified":"2024-08-07T05:52:14Z","updated_at":"2026-11-03T01:39:17.521372Z"}],"ghsa":[{"id":"GHSA-66r2-9m7r-3cvc","title":"The OAmon.sys kernel driver 3.1.0.0 and earlier in Tall Emu Online Armor Personal Firewall AV+...","description":"The OAmon.sys kernel driver 3.1.0.0 and earlier in Tall Emu Online Armor Personal Firewall AV+ before 3.5.0.12, and Personal Firewall 3.5 before 3.5.0.14, allows local users to gain privileges via crafted METHOD_NEITHER IOCTL requests to \\Device\\OAmon containing arbitrary kernel addresses, as demonstrated using the 0x830020C3 IOCTL.","status":"published","published":"2022-05-02T03:35:19Z","modified":"2023-01-31T05:07:28Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:49:13.084976Z"}],"nvd":[{"id":"CVE-2009-2450","description":"The OAmon.sys kernel driver 3.1.0.0 and earlier in Tall Emu Online Armor Personal Firewall AV+ before 3.5.0.12, and Personal Firewall 3.5 before 3.5.0.14, allows local users to gain privileges via crafted METHOD_NEITHER IOCTL requests to \\Device\\OAmon containing arbitrary kernel addresses, as demonstrated using the 0x830020C3 IOCTL.","status":"published","published":"2009-07-13T17:30:00.343Z","modified":"2026-06-16T23:09:28.523Z","cvss":[{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:01:36.200173Z"}]}}