Outpost Firewall PRO 4.0 - Local Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22069/info Outpost Firewall PRO is prone to a local privilege-escalation vulnerability because it fails to perform adequate SSDT System Service Descriptor Table hooking on files in its installation directory. A local...

RootRepeal – Rootkit Detector v1.3.5 Download Now

RootRepeal – Rootkit Detector v1.3.5 Download Now RootRepeal is a new rootkit detector currently in public beta. It is designed with the following goals in mind: Easy to use – a user with little to no computer experience should be able to use it. Powerful – it should be able to detect all publicl...

KHOBE - 8.0 earthquake for Windows desktop security software

Hello, We have found number of vulnerabilities in implementations of kernel hooks in many different security products. The argument-switch attack or KHOBE attack affects user mode and kernel mode hooks that are used to implement security features. The hook may be vulnerable if it performs securit...

Rising AntiVirus 2008/2009/2010 Local Privilege Escalation Exploit-vulnerability warning-the black bar safety net

Affected version:Rising AntiVirus 2 0 0 8 / 2 0 0 9 / 2 0 1 0 漏洞 描述 :RsNtGdi.sys not verify the Irp-UserBuffer address. The virus code will restore all of the kernel SSDT hook include "stdafx. h" include "windows. h" enum SystemModuleInformation = 1 1 ; typedef struct ULONG Unknown1; ULONG...

Rising AntiVirus 2008/2009/2010 - Local Privilege Escalation

//by Dlrow [email protected] //restore all ssdt hooks // Rising0day.cpp : Defines the entry point for the console application. // include "stdafx.h" include "windows.h" enum SystemModuleInformation = 11 ; typedef struct ULONG Unknown1; ULONG Unknown2; PVOID Base; ULONG Size; ULONG Flags; USHORT...

Rising AntiVirus 2008/2009/2010 Local Privilege Escalation Exploit

RsNtGdi.sys not verify the Irp-UserBuffer address. Exploit code will restore all of the kernel SSDT hook Rising AntiVirus 2008 / 2009 / 2010 none include "stdafx.h" include "windows.h" enum SystemModuleInformation = 11 ; typedef struct ULONG Unknown1; ULONG Unknown2; PVOID Base; ULONG Size; ULONG...

Kill IceSword-vulnerability warning-the black bar safety net

Posted By Inking This article is a study of the Rootkit... and the SSDT Hook magical－against ring0 inline hook after the results. According to the SSDT Hook magical－against ring0 inline hook said, IceSword inline Hook the NtOpenProcess function, but when I wrote out the code when how also unable ...

2 0 0 8 all the active Defense of ideas-vulnerability warning-the black bar safety net

| Hello everyone, I'm a sailor, and talked about soft kill active Defense, but this year a hot topic, mostly what modify time is too Kabbah take the initiative and restore SSDT table topics like, now to modify the time through the Kabbah take the initiative on the new version of the card bar has ...

Code injection

Rising Antivirus 2008 before 20.38.20 allows local users to cause a denial of service system crash via an invalid pointer to the CLIENTID structure in a call to the NtOpenProcess hooked System Service Descriptor Table SSDT function...

CVE-2008-1736

Comodo Firewall Pro before 3.0 does not properly validate certain parameters to hooked System Service Descriptor Table SSDT functions, which allows local users to cause a denial of service system crash via 1 a crafted OBJECTATTRIBUTES structure in a call to the NtDeleteFile function, which leads ...

CVE-2008-1738

Rising Antivirus 2008 before 20.38.20 allows local users to cause a denial of service system crash via an invalid pointer to the CLIENTID structure in a call to the NtOpenProcess hooked System Service Descriptor Table SSDT function...

Code injection

BitDefender Antivirus 2008 20080118 and earlier allows local users to cause a denial of service system crash via an invalid pointer to the CLIENTID structure in a call to the NtOpenProcess hooked System Service Descriptor Table SSDT function...

Comodo防火墙SSDT钩子多个本地拒绝服务漏洞

BUGTRAQ ID: 28742 CVECAN ID: CVE-2008-1736 Comodo是一款功能强大的个人防火墙。 Comodo防火墙的NtDeleteFile、NtCreateFile和NtSetThreadContext函数没有正确地验证参数，本地攻击者可能利用此漏洞导致防火墙不可用。 NtDeleteFile只接收了一个参数，也就是指向OBJECTATTRIBUTES结构的指针，这些属性会包含ObjectName和SECURITYDESCRIPTOR。例如，以下是Comodo在NtDeleteFile所设置的钩子： /----------- NTDeleteFile...

BitDefender Antivirus无效SSDT参数本地拒绝服务漏洞

BUGTRAQ ID: 28741 CVECAN ID: CVE-2008-1735 BitDefender Antivirus 2008是具有功能强大的反病毒引擎以及互联网过滤技术的杀毒软件。 BitDefender没有正确地验证提供给NtOpenProcess的CLIENTID结构指针，如果传送了无效指针的话，就会导致整个系统崩溃。 /----------- NtOpenProcessPHANDLE ProcessHandle, ACCESSMASK AccessMask, POBJECTATTRIBUTES ObjectAttributes, PCLIENTID ClientId...

瑞星杀毒软件SSDT NtOpenProcess()钩子本地拒绝服务漏洞

BUGTRAQ ID: 28744 CVECAN ID: CVE-2008-1738 瑞星是中国的一家非常著名的杀毒软件厂商。 瑞星的驱动实现上存在漏洞，本地攻击者可能利用此漏洞导致系统崩溃。 瑞星杀毒软件的NtOpenProcess钩子没有验证以下结构的指针： /----------- typedef struct CLIENTID HANDLE UniqueProcess; HANDLE UniqueThread; - -----------/ 是否指向了所映射的内存，当代码试图引用指针检查CLIENTID-UniqueProcess值时，如果指向了无效的内存，系统就会崩溃。...

CVE-2008-1738

CVE-2008-1738 is a kernel‑mode vulnerability involving insufficient argument validation of hooked SSDT functions in multiple antivirus products. The CoreLabs CORE-2008-0320 advisory documents an invalid memory reference vulnerability that can cause local DoS (system crash) and, in some cases, may...

CVE-2008-1735

BitDefender Antivirus 2008 20080118 and earlier allows local users to cause a denial of service system crash via an invalid pointer to the CLIENTID structure in a call to the NtOpenProcess hooked System Service Descriptor Table SSDT function...

CVE-2008-1736

CVE-2008-1736 relates to Comodo Firewall Pro 2.4.18.184 where hooked SSDT functions do not properly validate arguments (notably NtDeleteFile, NtCreateFile, NtSetThreadContext). This can allow a local attacker to trigger a Denial of Service (system crash). The issue is described in CoreLabs CORE-2...

CORE-2008-0320 - Insufficient argument validation of hooked SSDT functions on multiple Antivirus and Firewalls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Insufficient argument validation of hooked SSDT functions on multiple Antivirus and Firewalls Advisory Information Title: Insufficient argument validation of hooked...

Explain in detail the hacker used a remote control Trojan horse-vulnerability warning-the black bar safety net

Like browsing online the news people will often see someone privacy is hack theft, or in order to blackmail the victim thing. Here we might ask, How do they do it? In fact, the answer is very simple, but is the use of a remote Trojan to achieve control, the following the author will for the hacki...