Sygate Personal Firewall Pro Local Fail-Close Bypass Vulnerability

Bugtraq ID:	10540
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 14 2004 12:00AM
Updated:	Jun 14 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Tan Chew Keong.
Vulnerable:	Sygate Sygate Personal Firewall 5.5 build 2576 Sygate Security Agent 3.5 build 2576 Sygate Security Agent 3.0
Not Vulnerable:	Sygate Sygate Personal Firewall 5.5 build 2577 Sygate Security Agent 4.0 Sygate Security Agent 3.5 build 2577

Sygate Personal Firewall Pro Local Fail-Close Bypass Vulnerability

A vulnerability is reported to affect the Sygate Personal Firewall fail-closed functionality. It is reported that the kernel-space NDIS driver does not verify the origin of messages that are received through the associated device. As a result of this it is possible for a local user to transmit a message to the kernel-space NDIS driver device in order to disable the firewall fail-closed functionality.

A local attacker may exploit this condition to disable the affected firewall completely.

Sygate Personal Firewall Pro Local Fail-Close Bypass Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/sygateFW.txt

Sygate Personal Firewall Pro Local Fail-Close Bypass Vulnerability

Solution:
The vendor has released updates to address this issue. Please contact the vendor to obtain fixes.

Sygate Personal Firewall Pro Local Fail-Close Bypass Vulnerability

References:

• Sygate Homepage (Sygate)
  
• Sygate Personal Firewall PRO's Driver May be Disabled Locally by Malicious Progr (SIG^2 Vulnerability Research)