PT-2007-6148 · Zonealarm · Zonealarm Pro

Published 2007-09-24 · Updated 2018-10-15 · CVE-2007-5044

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZoneAlarm Pro version 7.0.362.000

Description The issue arises from improper validation of certain parameters to System Service Descriptor Table (SSDT) function handlers. This can be exploited by local users to cause a denial of service (crash) and potentially gain privileges. The exploitation is related to the NtCreatePort and NtDeleteFile kernel SSDT hooks.

Recommendations For ZoneAlarm Pro version 7.0.362.000, consider restricting access to the NtCreatePort and NtDeleteFile kernel SSDT hooks as a temporary mitigation measure until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-5044

Affected Products

Zonealarm Pro

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-5044 · Security Note
• http://osvdb.org/45898 · Note
• http://matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php · Note
• http://matousec.com/info/advisories/plague-in-security-software-drivers.php · Note
• http://securityfocus.com/archive/1/479830/100/0/threaded · Note
• http://securityreason.com/securityalert/3161 · Note