PT-2007-3425 · Check Point Zone · Zonealarm Pro

Publicado 2007-04-18 · Atualizado 2018-10-16 · CVE-2007-2083

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Check Point Zone Labs ZoneAlarm Pro versions prior to 7.0.302.000

Description The issue allows local users to cause a denial of service (system crash) or possibly execute arbitrary code via crafted arguments to the (1) NtCreateKey and (2) NtDeleteFile functions, due to the vsdatant.sys component not validating certain arguments before being passed to hooked SSDT function handlers.

Recommendations For versions prior to 7.0.302.000, update to version 7.0.302.000 or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2007-2083

Produtos afetados

Zonealarm Pro

Referências · 7

• 🔥 https://exploit-db.com/exploits/29860 · Exploit
• http://securityreason.com/securityalert/2591 · Nota
• http://securityfocus.com/archive/1/465868/100/0/threaded · Nota
• http://osvdb.org/35239 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33664 · Nota
• http://matousec.com/info/advisories/ZoneAlarm-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-2083 · Nota de Segurança