PT-2007-1804 · Agnitum · Agnitum Outpost Firewall Pro

Published 2007-01-18 · Updated 2018-10-16 · CVE-2007-0333

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Agnitum Outpost Firewall PRO version 4.0

Description: The issue allows local users to bypass access restrictions. This is achieved by creating links using FileLinkInformation requests with the ZwSetInformationFile function. It has been demonstrated that this can be used to insert Trojan horse drivers into the product's installation directory, such as modifying SandBox.sys.

Recommendations: For Agnitum Outpost Firewall PRO version 4.0, consider restricting access to the installation directory to prevent unauthorized modifications until a fix is available. As a temporary workaround, avoid using the ZwSetInformationFile function for creating links with FileLinkInformation requests.

Exploit

Fix

Related Identifiers

CVE-2007-0333

Affected Products

Agnitum Outpost Firewall Pro

References · 8

• 🔥 http://securityfocus.com/bid/22069 · Exploit
• 🔥 https://exploit-db.com/exploits/29465 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0333 · Security Note
• http://matousec.com/info/advisories/Outpost-Bypassing-Self-Protection-using-file-links.php · Vendor Advisory
• http://securityfocus.com/archive/1/456973/100/0/threaded · Note
• http://osvdb.org/33480 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31529 · Note
• http://securityreason.com/securityalert/2163 · Note