PT-2007-1804 · Agnitum · Agnitum Outpost Firewall Pro

Publicado 2007-01-18 · Atualizado 2018-10-16 · CVE-2007-0333

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Agnitum Outpost Firewall PRO version 4.0

Description: The issue allows local users to bypass access restrictions. This is achieved by creating links using FileLinkInformation requests with the ZwSetInformationFile function. It has been demonstrated that this can be used to insert Trojan horse drivers into the product's installation directory, such as modifying SandBox.sys.

Recommendations: For Agnitum Outpost Firewall PRO version 4.0, consider restricting access to the installation directory to prevent unauthorized modifications until a fix is available. As a temporary workaround, avoid using the ZwSetInformationFile function for creating links with FileLinkInformation requests.

Exploit

Correção

Identificadores relacionados

CVE-2007-0333

Produtos afetados

Agnitum Outpost Firewall Pro

Referências · 8

• 🔥 http://securityfocus.com/bid/22069 · Exploit
• 🔥 https://exploit-db.com/exploits/29465 · Exploit
• http://securityfocus.com/archive/1/456973/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0333 · Nota de Segurança
• http://osvdb.org/33480 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31529 · Nota
• http://matousec.com/info/advisories/Outpost-Bypassing-Self-Protection-using-file-links.php · Aviso do Fabricante
• http://securityreason.com/securityalert/2163 · Nota