PT-2007-6148 · Zonealarm · Zonealarm Pro

Publicado 2007-09-24 · Atualizado 2018-10-15 · CVE-2007-5044

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZoneAlarm Pro version 7.0.362.000

Description The issue arises from improper validation of certain parameters to System Service Descriptor Table (SSDT) function handlers. This can be exploited by local users to cause a denial of service (crash) and potentially gain privileges. The exploitation is related to the NtCreatePort and NtDeleteFile kernel SSDT hooks.

Recommendations For ZoneAlarm Pro version 7.0.362.000, consider restricting access to the NtCreatePort and NtDeleteFile kernel SSDT hooks as a temporary mitigation measure until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-5044

Produtos afetados

Zonealarm Pro

Referências · 6

• http://osvdb.org/45898 · Nota
• http://matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php · Nota
• http://matousec.com/info/advisories/plague-in-security-software-drivers.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5044 · Nota de Segurança
• http://securityfocus.com/archive/1/479830/100/0/threaded · Nota
• http://securityreason.com/securityalert/3161 · Nota