iDefense Security Advisory 04.03.07: Microsoft Windows WMF Triggerable Kernel Design Error DoS Vulnerability

Microsoft Windows WMF Triggerable Kernel Design Error DoS Vulnerability iDefense Security Advisory 04.03.07 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 03, 2007 I. BACKGROUND The Microsoft Windows kernel controls which processes are allowed to run and is responsible for accessing...

CVE-2006-7178: Undefined Security Weakness

MadWifi before 0.9.3 does not properly handle reception of an AUTH frame by an IBSS node, which allows remote attackers to cause a denial of service system crash via a certain AUTH frame...

CVE-2005-4835: Undefined Security Weakness

The athratesample function in the athrate/sample/sample.c sample code in MadWifi before 0.9.3 allows remote attackers to cause a denial of service failed KASSERT and system crash by moving a connected system to a location with low signal strength, and possibly other vectors related to a race...

Linux Kernel IPV6_SockGlue.c NULL指针引用漏洞

Linux是一款开放源代码的操作系统。 Linux Kernel IPV6SockGlue.c存在NULL指针引用问题，本地攻击者可以利用漏洞可对内核进行拒绝服务攻击，导致系统崩溃。 目前没有详细漏洞细节提供。 Linux kernel 2.6.20 Linux kernel 2.6.20 Linux kernel 2.6.19 1 Linux kernel 2.6.19 .2 Linux kernel 2.6.19 .1 Linux kernel 2.6.19 -rc4 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Lin...

Design/Logic Flaw

The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.1.7, and possibly other products using symevent.sys 12.0.0.20, allows local users to cause a denial of service system crash via invalid data, as demonstrated by calling DeviceIoControl to send the data, a reintroduction of...

CVE-2007-1495

The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.1.7, and possibly other products using symevent.sys 12.0.0.20, allows local users to cause a denial of service system crash via invalid data, as demonstrated by calling DeviceIoControl to send the data, a reintroduction of...

CVE-2007-1495

The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.1.7, and possibly other products using symevent.sys 12.0.0.20, allows local users to cause a denial of service system crash via invalid data, as demonstrated by calling DeviceIoControl to send the data, a reintroduction of...

CVE-2007-1476

The SymTDI device driver SYMTDI.SYS in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiVirus Corporate Edition 3.0.x through 10.1.x, and other Norton products, allows local users to cause a denial of service system crash by sending crafted data to...

CVE-2007-1476: Improper Input Validation

The SymTDI device driver SYMTDI.SYS in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiVirus Corporate Edition 3.0.x through 10.1.x, and other Norton products, allows local users to cause a denial of service system crash by sending crafted data to...

CVE-2007-1495: Undefined Security Weakness

The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.1.7, and possibly other products using symevent.sys 12.0.0.20, allows local users to cause a denial of service system crash via invalid data, as demonstrated by calling DeviceIoControl to send the data, a reintroduction of...

Mac OS X kernel "fpathconf()" syscall fails to properly handle unknown file types

Overview A vulnerability in the Mac OS X kernel could allow an authenticated local attacker to cause a denial of service. Description The fpathconf system call provides a method for applications to determine the current value of a configurable system limit or option variable associated with a fil...

Linux setsockopt / getsockopt IPv6 DoS

IPV6RTHDR option with invalid value causes system crash...

Apple QuickTime QTIF heap buffer overflow

Overview Apple QuickTime is vulnerable to a heap buffer overflow which may allow an attacker to execute arbitrary code or crash the system. Description A vulnerability exists in the way Apple QuickTime handles specially crafted QuickTime Image QTIF files. According to Apple QuickTime 7.1.5 securi...

RedHat linux DoS through audit subsystem

Replcaing of watched file causes system crash...

Important: Red Hat Security Advisory: kernel security update

Updated kernel packages that fix two security issues and a bug in the Red Hat Enterprise Linux 4 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system...

Comodo Firewall CMDMon.SYS多个拒绝服务漏洞

Comodo Firewall Pro是一款防火墙应用程序。 Comodo Firewall Pro存在设计错误，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 Comodo Firewall Pro在SSDT中HOOK多个函数，但缺少对来自用户模式中的参数数据，用户使用非法的参数调用NtConnectPort CFP 2.4.16.174不受影响, NtCreatePort CFP 2.4.16.174不受影响, NtCreateSection, NtOpenProcess, NtOpenSection, NtOpenThread...

Design/Logic Flaw

cmdmon.sys in Comodo Firewall Pro formerly Comodo Personal Firewall before 2.4.16.174 does not validate arguments that originate in user mode for the 1 NtConnectPort and 2 NtCreatePort hooked SSDT functions, which allows local users to cause a denial of service system crash and possibly gain...

CVE-2007-0708

cmdmon.sys in Comodo Firewall Pro formerly Comodo Personal Firewall before 2.4.16.174 does not validate arguments that originate in user mode for the 1 NtConnectPort and 2 NtCreatePort hooked SSDT functions, which allows local users to cause a denial of service system crash and possibly gain...

CVE-2007-0709

cmdmon.sys in Comodo Firewall Pro formerly Comodo Personal Firewall 2.4.16.174 and earlier does not validate arguments that originate in user mode for the 1 NtCreateSection, 2 NtOpenProcess, 3 NtOpenSection, 4 NtOpenThread, and 5 NtSetValueKey hooked SSDT functions, which allows local users to...

CVE-2007-0708

Affected software : Comodo Firewall Pro (formerly Comodo Personal Firewall) prior to 2.4.16.174. Vulnerable component / root cause : cmdmon.sys, with insufficient validation of user-mode arguments for the hooked SSDT functions NtConnectPort and NtCreatePort. Impact : local users can trigger a den...