PT-2006-5334 · Ibm · Blackice Pc Protection

David Matousek · Published 2006-09-05 · Updated 2018-10-17 · CVE-2006-4541

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BlackICE PC Protection versions 3.6.cpn, 3.6.cpj, 3.6.cpiE, and possibly 3.6 and earlier BlackICE PC Protection version 3.6.cqn

Description The issue allows local users to cause a denial of service, resulting in a crash, by providing a NULL third argument to the NtOpenSection API function.

Recommendations For BlackICE PC Protection versions 3.6.cpn, 3.6.cpj, 3.6.cpiE, 3.6.cqn, and possibly 3.6 and earlier, consider avoiding the use of the NtOpenSection API function with a NULL third argument until a patch is available. As a temporary workaround, consider restricting access to the RapDrv.sys driver to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2006-4541

Affected Products

Blackice Pc Protection

References · 12

• 🔥 https://exploit-db.com/exploits/28469 · Exploit
• http://secunia.com/advisories/21710 · Vendor Advisory
• http://vupen.com/english/advisories/2006/3431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4541 · Security Note
• http://securityfocus.com/bid/19800 · Note
• http://securityfocus.com/archive/1/444958/100/0/threaded · Note
• http://matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php · Note
• http://osvdb.org/28332 · Note
• http://matousec.com/info/advisories/plague-in-security-software-drivers.php · Note
• http://securityreason.com/securityalert/1512 · Note
• http://matousec.com/info/advisories/BlackICE-Insufficient-validation-of-arguments-of-NtOpenSection.php · Note
• http://securityfocus.com/archive/1/479830/100/0/threaded · Note