PT-2007-6081 · Microsoft · Windows

Publicado 2007-09-18 · Atualizado 2018-10-15 · CVE-2007-4967

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Média

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Online Armor Personal Firewall version 2.0.1.215

Description The issue arises from improper validation of certain parameters to System Service Descriptor Table (SSDT) function handlers, allowing local users to cause a denial of service (crash) and possibly gain privileges. This is achieved through unspecified kernel SSDT hooks for various Windows Native API functions, including NtAllocateVirtualMemory, NtConnectPort, NtCreateFile, NtCreateKey, NtCreatePort, NtDeleteFile, NtDeleteValueKey, NtLoadKey, NtOpenFile, NtOpenProcess, NtOpenThread, NtResumeThread, NtSetContextThread, NtSetValueKey, NtSuspendProcess, NtSuspendThread, and NtTerminateThread.

Recommendations To resolve the issue, update to a version of Online Armor Personal Firewall that properly validates parameters to SSDT function handlers. As a temporary workaround, consider restricting access to the Windows Native API functions until a patch is available.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-264

CWE-20

Identificadores relacionados

CVE-2007-4967

Produtos afetados

Windows

Referências · 7

• http://matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php · Nota
• http://securityfocus.com/bid/25711 · Nota
• http://osvdb.org/45951 · Nota
• http://matousec.com/info/advisories/plague-in-security-software-drivers.php · Nota
• http://securityfocus.com/archive/1/479830/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4967 · Nota de Segurança
• http://securityfocus.com/archive/1/archive/1/479830/100/0/threaded · Nota