CVE-2007-1689

The CVE-2007-1689 entry concerns a stack buffer overflow in the ISAlertDataCOM ActiveX control (ISLALERT.DLL) shipped with Norton Personal Firewall 2004 and Norton Internet Security 2004. The vulnerability is triggered by long arguments to the Get() and Set() methods of the ISAlertDataCOM control...

Bypassing PFW/HIPS open process control with uncommon identifier

Hello, We would like to inform you about a vulnerability in personal firewalls and HIPS software. Description: Windows operating systems with NT kernel version 5.0 and higher i.e. Windows 2000, XP, 2003 use integer numbers divisible by four to identify processes. Internal implementation of system...

Multiple Personal Firewall Products - Local Protection Mechanism Bypass

source: https://www.securityfocus.com/bid/23987/info Multiple personal firewall products are prone to a vulnerability that lets attackers bypass protection mechanisms. This issue occurs because the applications fail to properly implement protection mechanisms based on valid process identifiers...

Multiple Personal Firewall Products - Local Protection Mechanism Bypass

Multiple Personal Firewall Products - Local Protection Mechanism Bypass source: https://www.securityfocus.com/bid/23987/info Multiple personal firewall products are prone to a vulnerability that lets attackers bypass protection mechanisms. This issue occurs because the applications fail to proper...

CVE-2007-1793

SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service crash or possibly execute arbitrary code via crafted arguments to the 1...

CVE-2007-1793

SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service crash or possibly execute arbitrary code via crafted arguments to the 1...

CVE-2007-1793

SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 (versions 9.1.0.33 and 9.1.1.7) does not validate certain arguments passed to hooked SSDT function handlers, allowing local users to crash the system or potentially execute arbitrary code via crafted arguments to NtCreateMutant and NtOpenEven...

[Full-disclosure] Norton Multiple insufficient argument validation of hooked SSDT function Vulnerability

Hello, We would like to inform you about a vulnerability in Symantec Norton products. Description: Symantec Norton Personal Firewall hooks many functions in SSDT and in at least two cases it fails to validate arguments that come from the user mode. User calls to NtCreateMutant and NtOpenEvent wit...

Symantec Norton Personal Firewall 2006 SymEvent驱动本地拒绝服务漏洞

Symantec Norton Personal Firewall是一款流行的个人桌面防火墙。 Symantec Norton Personal Firewall 2006包含的SymEvent驱动存在问题，本地攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 SymEvent不充分保护其他恶意应用程序对'\Device\SymEvent'的操作及对输入缓冲区验证存在问题，可导致可以打开这个驱动，发送任意数据给它，而驱动没有进行验证的就认为输入合法，可组合输入缓冲区中的数据执行非法内存操作，使系统崩溃。 Symantec Norton Personal Firewall 2006 9.1....

CVE-2007-1495

The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.1.7, and possibly other products using symevent.sys 12.0.0.20, allows local users to cause a denial of service system crash via invalid data, as demonstrated by calling DeviceIoControl to send the data, a reintroduction of...

CVE-2007-1495

The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.1.7, and possibly other products using symevent.sys 12.0.0.20, allows local users to cause a denial of service system crash via invalid data, as demonstrated by calling DeviceIoControl to send the data, a reintroduction of...

CVE-2007-1495

The CVEs concern Symantec Norton Personal Firewall 2006 (9.1.1.7) and related Norton products using symevent.sys 12.0.0.20/SYMTDI.SYS. Affected component: \Device\SymEvent and driver interface; root cause is sending crafted data to the driver (e.g., via DeviceIoControl) that leads to invalid memo...

Design/Logic Flaw

The SymTDI device driver SYMTDI.SYS in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiVirus Corporate Edition 3.0.x through 10.1.x, and other Norton products, allows local users to cause a denial of service system crash by sending crafted data to...

CVE-2007-1476

The SymTDI device driver SYMTDI.SYS in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiVirus Corporate Edition 3.0.x through 10.1.x, and other Norton products, allows local users to cause a denial of service system crash by sending crafted data to...

Symantec Norton个人防火墙SymTDI驱动本地拒绝服务漏洞

Symantec Norton个人防火墙是非常流行的防火墙软件。 Norton个人防火墙的驱动实现上存在漏洞，本地攻击者可能利用此漏洞导致系统崩溃。 Norton个人防火墙没有充分地保护其\Device\SymEvent驱动，且没有验证输入缓冲区，因此本地攻击者可以打开这个驱动并发送被认为是有效的任意数据。当在输入缓冲区中重组数据时驱动可能会执行无效的内存操作，导致整个操作系统拒绝服务。 Symantec Norton Personal Firewall 2006 9.1.1.7 Symantec Norton Personal Firewall 2006 9.1.0.33 Symant...

Symantec Norton Personal Firewall / Norton Internet Security buffer overflow

DeviceSymEvent driver interface buffer overflow...

SymEvent Driver Local Access System Denial of Service

Hello, Today, we have accidentally discovered that the vulnerability, which is described here http://www.symantec.com/avcenter/security/Content/2006.09.20a.html and its third party identifications are BID: 20051 Secunia Advisory: SA21938 CVE: CVE-2006-4855 is active again in the today's update of...

CA personal firewall multiple privilege escalations

Multiple vulnerabilities in HIPS Core KmxStart.sys and HIPS Firewall KmxFw.sysdrivers...

[CAID 34818]: CA Personal Firewall Multiple Privilege Escalation Vulnerabilities

Title: CAID 34818: CA Personal Firewall Multiple Privilege Escalation Vulnerabilities CA Vuln ID CAID: 34818 CA Advisory Date: 2007-01-22 Discovered By: Reverse Mode Impact: Local attacker can gain escalated privileges. Summary: Multiple vulnerabilities have been discovered in CA Personal Firewal...

CVE-2007-0081

Sunbelt Kerio Personal Firewall SKPF 4.3.268 and 4.3.246, and possibly other versions allows local users to provide a Trojan horse iphlpapi.dll to SKPF by placing it in the installation directory...