PT-2008-3277 · Comodo · Comodo Firewall Pro

Andres Blanco + 5 · Published 2008-04-29 · Updated 2018-10-11 · CVE-2008-1736

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Comodo Firewall Pro versions prior to 3.0

Description The issue arises from improper validation of certain parameters to hooked System Service Descriptor Table (SSDT) functions. This can be exploited by local users to cause a denial of service, resulting in a system crash. The exploitation vectors include a crafted OBJECT ATTRIBUTES structure in a call to the NtDeleteFile function, leading to improper validation of a ZwQueryObject result, as well as unspecified calls to the NtCreateFile and NtSetThreadContext functions.

Recommendations For Comodo Firewall Pro versions prior to 3.0, update to version 3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the NtDeleteFile, NtCreateFile, and NtSetThreadContext functions to minimize the risk of exploitation. Additionally, avoid using crafted OBJECT ATTRIBUTES structures in calls to the NtDeleteFile function until the issue is resolved.

Fix

Related Identifiers

CVE-2008-1736

Affected Products

Comodo Firewall Pro

References · 10

• http://securityfocus.com/bid/28742 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-1736 · Security Note
• http://secunia.com/advisories/30006 · Vendor Advisory
• http://personalfirewall.comodo.com/release_notes.html · Note
• http://securitytracker.com/id?1019944 · Note
• http://securityfocus.com/archive/1/491405/100/0/threaded · Note
• http://securityreason.com/securityalert/3838 · Note
• http://coresecurity.com/?action=item&id=2249 · Note
• http://vupen.com/english/advisories/2008/1383 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42082 · Note