Bypassing PFW/HIPS open process control with uncommon identifier

Hello, We would like to inform you about a vulnerability in personal firewalls and HIPS software. Description: Windows operating systems with NT kernel version 5.0 and higher i.e. Windows 2000, XP, 2003 use integer numbers divisible by four to identify processes. Internal implementation of system...

CVE-2007-2730: Undefined Security Weakness

Check Point ZoneAlarm Pro before 6.5.737.000 does not properly test for equivalence of process identifiers for certain Microsoft Windows API functions in the NT kernel 5.0 and greater, which allows local users to call these functions, and bypass firewall rules or gain privileges, via a modified...

Multiple Personal Firewall Products - Local Protection Mechanism Bypass

source: https://www.securityfocus.com/bid/23987/info Multiple personal firewall products are prone to a vulnerability that lets attackers bypass protection mechanisms. This issue occurs because the applications fail to properly implement protection mechanisms based on valid process identifiers...

Design/Logic Flaw

ZoneAlarm Pro 6.5.737.000, 6.1.744.001, and possibly earlier versions and other products, allows local users to cause a denial of service system crash by sending malformed data to the vsdatant device driver, which causes an invalid memory access...

CVE-2007-2467

CVE-2007-2467 concerns ZoneAlarm Pro versions 6.5.737.000, 6.1.744.001 (and possibly earlier versions) where local users can trigger a denial of service (system crash) by sending malformed data to the vsdatant device driver, leading to an invalid memory access. The provided documents confirm the ...

CVE-2007-2467: Undefined Security Weakness

ZoneAlarm Pro 6.5.737.000, 6.1.744.001, and possibly earlier versions and other products, allows local users to cause a denial of service system crash by sending malformed data to the vsdatant device driver, which causes an invalid memory access...

Design/Logic Flaw

vsdatant.sys in Check Point Zone Labs ZoneAlarm Pro before 7.0.302.000 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service system crash or possibly execute arbitrary code via crafted arguments to the 1...

CVE-2007-2083

vsdatant.sys in Check Point Zone Labs ZoneAlarm Pro before 7.0.302.000 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service system crash or possibly execute arbitrary code via crafted arguments to the 1...

CVE-2007-2083

vsdatant.sys in Check Point Zone Labs ZoneAlarm Pro before 7.0.302.000 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service system crash or possibly execute arbitrary code via crafted arguments to the 1...

CVE-2007-2083

This CVE (CVE-2007-2083) affects ZoneAlarm Pro and is caused by vsdatant.sys not validating arguments passed to hooked SSDT function handlers, enabling local attackers to crash the system or possibly execute arbitrary code via crafted arguments to NtCreateKey and NtDeleteFile. Affected product: Z...

CVE-2007-2083: Undefined Security Weakness

vsdatant.sys in Check Point Zone Labs ZoneAlarm Pro before 7.0.302.000 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service system crash or possibly execute arbitrary code via crafted arguments to the 1...

KLA10412 ACE vulnerability in ZoneAlarm

A lack of argument validation was found in ZoneAlarm. By exploiting this vulnerability malicious users can cause denial of service or possibly execute arbitrary code. This vulnerability can be exploited locally via specially designed arguments. Original advisories - Exploitation Public exploits...

ZoneAlarm Pro < 7.0.302.000 vsdatant Driver Local DoS

Binary data 3968.prm...

ZoneAlarm 6.1.744.0016.5.737.000 - Vsdatant.SYS Driver Local Denial of Service

ZoneAlarm 6.1.744.0016.5.737.000 - Vsdatant.SYS Driver Local Denial of Service // source: https://www.securityfocus.com/bid/23494/info ZoneAlarm is prone to a local denial-of-service vulnerability. This issue occurs when attackers supply invalid argument values to the 'vsdatant.sys' driver. A loc...

Breakthrough Proactive Defense registry monitoring review(updated)-vulnerability warning-the black bar safety net

Currently active Defense concept has been firmly established, many antivirus, software, fire protection, and HIPS are having a registry monitoring function, to prevent from startup items and IE-related key value is modified, to guard against viruses Trojans and malware and other malicious program...

ZoneAlarm Pro Local DoS Vulnerability (CVE-2004-2713)

ZoneAlarm Pro is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2002-1997

ZoneAlarm Pro 3.0 MailSafe allows remote attackers to bypass filtering and possibly execute arbitrary code via email attachments containing a trailing dot after the file extension...

CVE-2002-1997: Undefined Security Weakness

ZoneAlarm Pro 3.0 MailSafe allows remote attackers to bypass filtering and possibly execute arbitrary code via email attachments containing a trailing dot after the file extension...

CVE-2001-1548: Undefined Security Weakness

ZoneAlarm 2.1 through 2.6 and ZoneAlarm Pro 2.4 and 2.6 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol adapters...

CVE-2002-1911: Undefined Security Weakness

ZoneAlarm Pro 3.0 and 3.1, when configured to block all traffic, allows remote attackers to cause a denial of service CPU and memory consumption via a large number of SYN packets SYN flood. NOTE: the vendor was not able to reproduce the issue...