PT-2007-1407 · Iss · Blackice Pc Protection

Publicado 2007-03-06 · Atualizado 2018-10-16 · CVE-2006-7129

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ISS BlackICE PC Protection versions 3.6 and possibly earlier

Description The issue allows local users to bypass the protection scheme. This is achieved by using the ZwDeleteFile API function to delete the critical file filelock.txt, which stores information about protected files.

Recommendations For ISS BlackICE PC Protection version 3.6 and possibly earlier, consider restricting access to the ZwDeleteFile API function to prevent deletion of the filelock.txt file until a patch is available. As a temporary workaround, monitor the filelock.txt file for unauthorized modifications.

Exploit

Correção

Identificadores relacionados

CVE-2006-7129

Produtos afetados

Blackice Pc Protection

Referências · 9

• 🔥 https://exploit-db.com/exploits/28817 · Exploit
• http://osvdb.org/30901 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0298.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29575 · Nota
• http://securityreason.com/securityalert/2361 · Nota
• http://securityfocus.com/bid/20546 · Nota
• http://securityfocus.com/archive/1/448763/100/0/threaded · Nota
• http://matousec.com/info/advisories/BlackICE-Filelock-protection-bypass.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-7129 · Nota de Segurança