PT-2007-1407 · Iss · Blackice Pc Protection

Published 2007-03-06 · Updated 2018-10-16 · CVE-2006-7129

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ISS BlackICE PC Protection versions 3.6 and possibly earlier

Description The issue allows local users to bypass the protection scheme. This is achieved by using the ZwDeleteFile API function to delete the critical file filelock.txt, which stores information about protected files.

Recommendations For ISS BlackICE PC Protection version 3.6 and possibly earlier, consider restricting access to the ZwDeleteFile API function to prevent deletion of the filelock.txt file until a patch is available. As a temporary workaround, monitor the filelock.txt file for unauthorized modifications.

Exploit

Fix

Related Identifiers

CVE-2006-7129

Affected Products

Blackice Pc Protection

References · 9

• 🔥 https://exploit-db.com/exploits/28817 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-7129 · Security Note
• http://osvdb.org/30901 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-10/0298.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29575 · Note
• http://securityreason.com/securityalert/2361 · Note
• http://securityfocus.com/bid/20546 · Note
• http://securityfocus.com/archive/1/448763/100/0/threaded · Note
• http://matousec.com/info/advisories/BlackICE-Filelock-protection-bypass.php · Note