Kaspersky Internet Security privilege escalation

Invalid processing of SSDT hooked functions arguments...

Kaspersky Multiple insufficient argument validation of hooked SSDT function Vulnerability

Hello, We would like to inform you about a vulnerability in Kaspersky Internet Security 6. Description: Kaspersky Internet Security hooks many functions in SSDT and in at least nine cases it fails to validate arguments that come from the user mode. User calls to NtCreateKey, NtCreateProcess,...

Kaspersky Internet Security 6.0 - SSDT Hooks Multiple Local Vulnerabilities

source: https://www.securityfocus.com/bid/24491/info Kaspersky Internet Security 6 is prone to multiple local vulnerabilities. Exploiting these vulnerabilities allows local attackers to crash affected computers, denying service to legitimate users. Attackers might also be able to gain elevated...

Bypassing PFW/HIPS open process control with uncommon identifier

Hello, We would like to inform you about a vulnerability in personal firewalls and HIPS software. Description: Windows operating systems with NT kernel version 5.0 and higher i.e. Windows 2000, XP, 2003 use integer numbers divisible by four to identify processes. Internal implementation of system...

ZoneAlarm Vsdatant.SYS驱动本地拒绝服务漏洞

ZoneAlarm是一款流行的个人防火墙系统。 ZoneAlarm 'vsdatant.sys'驱动处理参数存在问题，本地攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 SSDT函数句柄执行在内核模式下执行，但他们的调用者执行在用户模式下，因此所有函数参数来自用户模式，所以必须严格验证这些参数，不正确使用这些函数可导致系统崩溃。 ZoneAlarm在SSDT中hook多个函数，其中至少有2个情况下缺少丢来自用户模式下的参数数据，由于Kerio驱动fwdrv.sys和khips.sys驱动的错误，用户调用不合法的NtCreateKey和NtDeleteFile参数值可导致系统崩溃。 Zon...

CVE-2007-2083: Undefined Security Weakness

vsdatant.sys in Check Point Zone Labs ZoneAlarm Pro before 7.0.302.000 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service system crash or possibly execute arbitrary code via crafted arguments to the 1...

ZoneAlarm Multiple insufficient argument validation of hooked SSDT function Vulnerability

Hello, We would like to inform you about a vulnerability in ZoneAlarm 6. Description: ZoneAlarm hooks many functions in SSDT and in at least two cases it fails to validate arguments that come from the user mode. User calls to NtCreateKey and NtDeleteFile with invalid argument values can cause...

ZoneAlarm 6.1.744.0016.5.737.000 - Vsdatant.SYS Driver Local Denial of Service

ZoneAlarm 6.1.744.0016.5.737.000 - Vsdatant.SYS Driver Local Denial of Service // source: https://www.securityfocus.com/bid/23494/info ZoneAlarm is prone to a local denial-of-service vulnerability. This issue occurs when attackers supply invalid argument values to the 'vsdatant.sys' driver. A loc...

Microsoft Windows - GDI Privilege Escalation (MS07-017) (1)

define WIN32WINNT 0x0500 include include include pragma comment lib, "user32.lib" pragma comment lib, "gdi32.lib" pragma comment lib, "shlwapi.lib" pragma comment lib, "ntdll.lib" / Here is a sploit for the GDI MS07-017 Local Privilege Escalation, presented during the last blackhat conferences by...

CVE-2007-1793

SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service crash or possibly execute arbitrary code via crafted arguments to the 1...

[Full-disclosure] Norton Multiple insufficient argument validation of hooked SSDT function Vulnerability

Hello, We would like to inform you about a vulnerability in Symantec Norton products. Description: Symantec Norton Personal Firewall hooks many functions in SSDT and in at least two cases it fails to validate arguments that come from the user mode. User calls to NtCreateMutant and NtOpenEvent wit...

CVE-2006-7160: Improper Input Validation

The Sandbox.sys driver in Outpost Firewall PRO 4.0, and possibly earlier versions, does not validate arguments to hooked SSDT functions, which allows local users to cause a denial of service crash via invalid arguments to the 1 NtAssignProcessToJobObject,, 2 NtCreateKey, 3 NtCreateThread, 4...

Breakthrough Proactive Defense registry monitoring review(updated)-vulnerability warning-the black bar safety net

Currently active Defense concept has been firmly established, many antivirus, software, fire protection, and HIPS are having a registry monitoring function, to prevent from startup items and IE-related key value is modified, to guard against viruses Trojans and malware and other malicious program...

Design/Logic Flaw

cmdmon.sys in Comodo Firewall Pro formerly Comodo Personal Firewall before 2.4.16.174 does not validate arguments that originate in user mode for the 1 NtConnectPort and 2 NtCreatePort hooked SSDT functions, which allows local users to cause a denial of service system crash and possibly gain...

CVE-2007-0708

cmdmon.sys in Comodo Firewall Pro formerly Comodo Personal Firewall before 2.4.16.174 does not validate arguments that originate in user mode for the 1 NtConnectPort and 2 NtCreatePort hooked SSDT functions, which allows local users to cause a denial of service system crash and possibly gain...

CVE-2007-0709: Undefined Security Weakness

cmdmon.sys in Comodo Firewall Pro formerly Comodo Personal Firewall 2.4.16.174 and earlier does not validate arguments that originate in user mode for the 1 NtCreateSection, 2 NtOpenProcess, 3 NtOpenSection, 4 NtOpenThread, and 5 NtSetValueKey hooked SSDT functions, which allows local users to...

Comodo Firewall Pro privilege escalation

Insufficient filtering of hooked SSDT functions potentially allows code execution in system content...

[Full-disclosure] Comodo Multiple insufficient argument validation of hooked SSDT function Vulnerability

Hello, We would like to inform you about a vulnerability in Comodo Firewall Pro. Description: Comodo Firewall Pro former Comodo Personal Firewall hooks many functions in SSDT and in at least seven cases it fails to validate arguments that come from the user mode. User calls to NtConnectPort CFP...

Outpost Firewall PRO本地特权提升漏洞

Outpost Firewall PRO是一款防火墙应用程序。 Outpost Firewall PRO执行SSDT HOOKING操作存在问题，本地攻击者可以利用漏洞提升特权。 Outpost Firewall PRO保护自身文件并禁止其他应用程序操作。在安装目录中的文件和目录通过各种SSDT HOOK来保护，但是这种保护实现没有防止恶意程序调用API ZwSetInformationFile class...

Outpost Firewall PRO 4.0 - Local Privilege Escalation

Outpost Firewall PRO 4.0 - Local Privilege Escalation source: https://www.securityfocus.com/bid/22069/info Outpost Firewall PRO is prone to a local privilege-escalation vulnerability because it fails to perform adequate SSDT System Service Descriptor Table hooking on files in its installation...