EUVD-2008-2919

Malware in sbrugna...

EUVD-2008-3164

Malware in sbrugna...

[TKADV2008-006] CA HIPS KmxFw.sys Kernel Memory Corruption

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: CA HIPS KmxFw.sys Kernel Memory Corruption Advisory ID: TKADV2008-006 Revision: 1.0 Release Date: 2008/08/12 Last Modified: 2008/08/12 Date Reported: 2008/03/08 Author: Tobias Klein tk at trapkit.de Affected Software: CA Host-Based Intrusion...

CA Host-Based Intrusion Prevention System SDK kmxfw.sys Multiple Vulnerabilities

Title: CA Host-Based Intrusion Prevention System SDK kmxfw.sys Multiple Vulnerabilities CA Advisory Date: 2008-08-11 Reported By: CVE-2008-2926 - Tobias Klein CVE-2008-3174 - Elazar Broad Impact: A remote attacker can cause a denial of service or possibly execute arbitrary code. Summary: CA...

Computer Associates 'kmxfw.sys'本地代码执行和远程拒绝服务漏洞

BUGTRAQ ID: 30651 CVE ID：CVE-2008-3174 CVE-2008-2926 CNCVE ID：CNCVE-20083174 CNCVE-20082926 CA HIPS包含漏洞允许本地攻击者导致系统崩溃或任意代码执行。漏洞是由于kmxfw.sys驱动不充分验证IOCTL请求引起的，攻击者发送IOCTL请求可导致系统崩溃或执行任意代码。 另外kmxfw.sys驱动不充分的验证可导致应用程序崩溃，造成拒绝服务攻击。 目前没有详细漏洞细节提供。 Computer Associates Personal Firewall 2008 Computer Associat...

Design/Logic Flaw

Unspecified vulnerability in the kmxfw.sys driver in CA Host-Based Intrusion Prevention System HIPS r8, as used in CA Internet Security Suite and Personal Firewall, allows remote attackers to cause a denial of service via unknown vectors, related to "insufficient validation."...

CVE-2008-3174

Unspecified vulnerability in the kmxfw.sys driver in CA Host-Based Intrusion Prevention System HIPS r8, as used in CA Internet Security Suite and Personal Firewall, allows remote attackers to cause a denial of service via unknown vectors, related to "insufficient validation."...

CVE-2008-2926

CVE-2008-2926 affects the kernel driver kmxfw.sys shipped with CA Host-Based Intrusion Prevention System (HIPS) r8 (also in CA Internet Security Suite and CA Personal Firewall). The vulnerability arises from insufficient verification of IOCTL requests, allowing a local attacker to crash the syste...

CA多个产品驱动本地权限提升漏洞

Computer Associates是世界领先的安全厂商，产品包括多种杀毒软件及备份恢复系统。 CA HIPS产品的驱动在实现上存在问题，本地攻击者可能利用此漏洞提升权限。 CA的HIPS Core（KmxStart.sys）和HIPS Firewall（KmxFw.sys）驱动hook了TDI和NDIS。本地非特权用户可以使用一些特权IOCTL覆盖这些驱动中的函数指针，以Ring0权限执行任意代码。 Computer Associates Personal Firewall 2007 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

[Reversemode advisory] Computer Associates HIPS Drivers - multiple local privilege escalation vulnerabilities.

Computer Associates "Host Intrusion Prevention System" Engine Drivers are prone to multiple local privilege escalation vulnerabilities. Unprivileged users can take advantage of these flaws in order to execute arbitrary code with kernel privileges. Two drivers are affected, kmxstart.sys and...