Sygate Personal Firewall Pro Local Denial Of Service Vulnerability

Bugtraq ID:	10542
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	No
Local:	Yes
Published:	Jun 14 2004 12:00AM
Updated:	Jun 14 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Tan Chew Keong.
Vulnerable:	Sygate Sygate Personal Firewall Pro 5.5
Not Vulnerable:

Sygate Personal Firewall Pro Local Denial Of Service Vulnerability

A local denial of service vulnerability is reported to affect the Sygate Personal Firewall. It is reported that the smc.exe service may be crashed using the List-View Control in the Sygate Personal Firewall GUI.

This issue may be exploited in conjunction with the issue described in BID 10540, in order to completely disable the affected firewall as an unprivileged user.

This vulnerability is reported to affect Sygate Personal Firewall PRO version 5.5 Build 2525. Other versions might also be affected.

Sygate Personal Firewall Pro Local Denial Of Service Vulnerability

The following proof of concept is available:

SendMessage(hHdrControl, HDM_GETITEMRECT, 1, (LPARAM)NON-WRITABLE_ADDR);

Sygate Personal Firewall Pro Local Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Sygate Personal Firewall Pro Local Denial Of Service Vulnerability

References:

• Sygate Personal Firewall PRO's Driver May be Disabled Locally by Malicious Progr (SIG^2 Vulnerability Research)