PT-2006-5891 · Sunbelt · Sunbelt Kerio Personal Firewall

David Matousek · Published 2006-10-03 · Updated 2018-10-17 · CVE-2006-5153

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Sunbelt Kerio Personal Firewall versions 4.3.268 and earlier

Description The issue concerns the fwdrv.sys and khips.sys drivers, which do not validate arguments passed to SSDT functions. This includes functions such as NtCreateFile, NtDeleteFile, NtLoadDriver, NtMapViewOfSection, NtOpenFile, and NtSetInformationFile. As a result, local users can cause a denial of service, potentially leading to a system crash, and possibly other impacts.

Recommendations For Sunbelt Kerio Personal Firewall versions 4.3.268 and earlier, consider updating to a version that addresses this issue, as the current version allows for potential denial of service and other impacts due to the lack of argument validation in the fwdrv.sys and khips.sys drivers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-5153

Affected Products

Sunbelt Kerio Personal Firewall

References · 9

• 🔥 http://matousec.com/info/advisories/Kerio-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.php · Exploit
• 🔥 http://securityfocus.com/bid/20299 · Exploit
• http://secunia.com/advisories/22234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5153 · Security Note
• http://securityfocus.com/archive/1/447504/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29313 · Note
• http://securityreason.com/securityalert/1685 · Note
• http://securitytracker.com/id?1016967 · Note
• http://vupen.com/english/advisories/2006/3872 · Note