PT-2008-3277 · Comodo · Comodo Firewall Pro

Andres Blanco + 5 · Publicado 2008-04-29 · Atualizado 2018-10-11 · CVE-2008-1736

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Comodo Firewall Pro versions prior to 3.0

Description The issue arises from improper validation of certain parameters to hooked System Service Descriptor Table (SSDT) functions. This can be exploited by local users to cause a denial of service, resulting in a system crash. The exploitation vectors include a crafted OBJECT ATTRIBUTES structure in a call to the NtDeleteFile function, leading to improper validation of a ZwQueryObject result, as well as unspecified calls to the NtCreateFile and NtSetThreadContext functions.

Recommendations For Comodo Firewall Pro versions prior to 3.0, update to version 3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the NtDeleteFile, NtCreateFile, and NtSetThreadContext functions to minimize the risk of exploitation. Additionally, avoid using crafted OBJECT ATTRIBUTES structures in calls to the NtDeleteFile function until the issue is resolved.

Correção

Identificadores relacionados

CVE-2008-1736

Produtos afetados

Comodo Firewall Pro

Referências · 10

• http://securityfocus.com/bid/28742 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-1736 · Nota de Segurança
• http://secunia.com/advisories/30006 · Aviso do Fabricante
• http://personalfirewall.comodo.com/release_notes.html · Nota
• http://securitytracker.com/id?1019944 · Nota
• http://securityfocus.com/archive/1/491405/100/0/threaded · Nota
• http://securityreason.com/securityalert/3838 · Nota
• http://coresecurity.com/?action=item&id=2249 · Nota
• http://vupen.com/english/advisories/2008/1383 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42082 · Nota