54 matches found
CA personal firewall multiple privilege escalations
Multiple vulnerabilities in HIPS Core KmxStart.sys and HIPS Firewall KmxFw.sysdrivers...
[CAID 34818]: CA Personal Firewall Multiple Privilege Escalation Vulnerabilities
Title: CAID 34818: CA Personal Firewall Multiple Privilege Escalation Vulnerabilities CA Vuln ID CAID: 34818 CA Advisory Date: 2007-01-22 Discovered By: Reverse Mode Impact: Local attacker can gain escalated privileges. Summary: Multiple vulnerabilities have been discovered in CA Personal Firewal...
CVE-2006-6952
Computer Associates Host Intrusion Prevention System HIPS drivers 1 Core kmxstart.sys 6.5.4.31 and 2 Firewall kmxfw.sys 6.5.4.10 allow local users to gain privileges by using certain privileged IOCTLs to modify callback function pointers...
CVE-2006-6952
CVE-2006-6952 affects CA Personal Firewall/CA Internet Security Suite 2007: HIPS Core (KmxStart.sys) and HIPS Firewall (KmxFw.sys) allow local privilege escalation by using privileged IOCTLs to modify callback pointers. Impact is local privilege escalation; affected products include CA Personal F...
CVE-2006-6952
Computer Associates Host Intrusion Prevention System HIPS drivers 1 Core kmxstart.sys 6.5.4.31 and 2 Firewall kmxfw.sys 6.5.4.10 allow local users to gain privileges by using certain privileged IOCTLs to modify callback function pointers...
多家厂商防火墙/HIPS进程欺骗漏洞
AntiHook、AVG Anti-Virus plus Firewall、Comodo Personal Firewall等都是非常流行的防火墙。 多个主机安全软件在处理用户态进程信息时存在漏洞，攻击者可能利用此漏洞绕过安全限制。 对每个进程实施安全保护的个人防火墙、HIPS和类似的安全软件必须能够识别出试图执行特权操作的进程。通常，这不仅需要名称和进程标识符，还需要进程的完整路径等信息。一些安全软件错误的从未知进程的用户态结构获得这些信息，这意味着这些安全软件依赖于可能会被恶意应用程序更改了的用户态数据，导致恶意进程看起来好像是其他进程，以绕过检测执行特权操作。 InfoProces...
Multiple Vendor Firewall - HIPS Process Spoofing
Multiple Vendor Firewall - HIPS Process Spoofing source: https://www.securityfocus.com/bid/21615/info Multiple vendor firewalls and HIPS host-based intrusion prevention systems are prone to a process-spoofing vulnerability. An attacker can exploit this issue to have an arbitrary malicious program...
Multiple Vendor Firewall - HIPS Process Spoofing
source: https://www.securityfocus.com/bid/21615/info Multiple vendor firewalls and HIPS host-based intrusion prevention systems are prone to a process-spoofing vulnerability. An attacker can exploit this issue to have an arbitrary malicious program appear to run as a trusted process and function...
Beat the security system of the series of articles of the breakthrough card bar 6-vulnerability warning-the black bar safety net
Beat the Security System Series0before the statement Recently more and more feel this stage all kinds of security system design there are some shortcomings, not the various possible security threats into account, in Cever Hackers front can not do anything. In order to help all kinds of security...
CA多个产品驱动本地权限提升漏洞
Computer Associates是世界领先的安全厂商，产品包括多种杀毒软件及备份恢复系统。 CA HIPS产品的驱动在实现上存在问题，本地攻击者可能利用此漏洞提升权限。 CA的HIPS Core（KmxStart.sys）和HIPS Firewall（KmxFw.sys）驱动hook了TDI和NDIS。本地非特权用户可以使用一些特权IOCTL覆盖这些驱动中的函数指针，以Ring0权限执行任意代码。 Computer Associates Personal Firewall 2007 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
[Reversemode advisory] Computer Associates HIPS Drivers - multiple local privilege escalation vulnerabilities.
Computer Associates "Host Intrusion Prevention System" Engine Drivers are prone to multiple local privilege escalation vulnerabilities. Unprivileged users can take advantage of these flaws in order to execute arbitrary code with kernel privileges. Two drivers are affected, kmxstart.sys and...
Computer Associates Personal Firewall 9.0 - HIPS Driver 'kmxstart.sys' Local Privilege Escalation
// source: https://www.securityfocus.com/bid/21140/info Multiple Computer Associates security-related products are prone to multiple local privilege-escalation vulnerabilities. An attacker can leverage these issues to execute arbitrary code with SYSTEM-level privileges. This could result in the...
Computer Associates Personal Firewall 9.0 - HIPS Driver kmxstart.sys Local Privilege Escalation
Computer Associates Personal Firewall 9.0 - HIPS Driver kmxstart.sys Local Privilege Escalation // source: https://www.securityfocus.com/bid/21140/info Multiple Computer Associates security-related products are prone to multiple local privilege-escalation vulnerabilities. An attacker can leverage...
Computer Associates Personal Firewall 9.0 - HIPS Driver 'kmxfw.sys' Local Privilege Escalation
// source: https://www.securityfocus.com/bid/21140/info Multiple Computer Associates security-related products are prone to multiple local privilege-escalation vulnerabilities. An attacker can leverage these issues to execute arbitrary code with SYSTEM-level privileges. This could result in the...