PT-2007-6084 · Unknown · Processguard

Publicado 2007-09-19 · Atualizado 2018-10-15 · CVE-2007-4970

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Média

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ProcessGuard version 3.410

Description The issue arises from improper validation of certain parameters to System Service Descriptor Table (SSDT) function handlers, allowing local users to cause a denial of service (crash) and possibly gain privileges. This is achieved through kernel SSDT hooks for various Windows Native API functions, including NtCreateFile, NtCreateKey, NtDeleteValueKey, NtOpenFile, NtOpenKey, and NtSetValueKey.

Recommendations For ProcessGuard version 3.410, consider updating to a newer version that properly validates parameters to SSDT function handlers to prevent potential denial of service and privilege escalation. As a temporary workaround, restrict access to the Windows Native API functions to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-4970

Produtos afetados

Processguard

Referências · 6

• http://matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php · Nota
• http://matousec.com/info/advisories/plague-in-security-software-drivers.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4970 · Nota de Segurança
• http://securityfocus.com/archive/1/479830/100/0/threaded · Nota
• http://osvdb.org/45954 · Nota
• http://securityfocus.com/bid/25714 · Nota