PT-2007-6084 · Unknown · Processguard

Published 2007-09-19 · Updated 2018-10-15 · CVE-2007-4970

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ProcessGuard version 3.410

Description The issue arises from improper validation of certain parameters to System Service Descriptor Table (SSDT) function handlers, allowing local users to cause a denial of service (crash) and possibly gain privileges. This is achieved through kernel SSDT hooks for various Windows Native API functions, including NtCreateFile, NtCreateKey, NtDeleteValueKey, NtOpenFile, NtOpenKey, and NtSetValueKey.

Recommendations For ProcessGuard version 3.410, consider updating to a newer version that properly validates parameters to SSDT function handlers to prevent potential denial of service and privilege escalation. As a temporary workaround, restrict access to the Windows Native API functions to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-4970

Affected Products

Processguard

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-4970 · Security Note
• http://matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php · Note
• http://matousec.com/info/advisories/plague-in-security-software-drivers.php · Note
• http://securityfocus.com/archive/1/479830/100/0/threaded · Note
• http://osvdb.org/45954 · Note
• http://securityfocus.com/bid/25714 · Note