DiamondCS Process Guard Service Description Table Restoration Vulnerability
BID:10675
Info
DiamondCS Process Guard Service Description Table Restoration Vulnerability
| Bugtraq ID: | 10675 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 07 2004 12:00AM |
| Updated: | Jul 07 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to Tan Chew Keong of SIG^2 Vulnerability Research. |
| Vulnerable: |
DiamondCS Process Guard Free 2.0 |
| Not Vulnerable: | |
Discussion
DiamondCS Process Guard Service Description Table Restoration Vulnerability
A vulnerability is reported to affect Process Guard that could permit an executable that is run by an administrator to disable Process Guard protection. It is reported that it is possible to restore the Service Description Table (SDT) to its original state. This can be accomplished because direct writes to certain devices are not controlled by the Process Guard driver-blocking feature. A malicious application that is run by an administrator can read an intact SDT table from kernel memory and restore the SDT table in the running kernel by writing to kernel memory space.
A vulnerability is reported to affect Process Guard that could permit an executable that is run by an administrator to disable Process Guard protection. It is reported that it is possible to restore the Service Description Table (SDT) to its original state. This can be accomplished because direct writes to certain devices are not controlled by the Process Guard driver-blocking feature. A malicious application that is run by an administrator can read an intact SDT table from kernel memory and restore the SDT table in the running kernel by writing to kernel memory space.
Exploit / POC
DiamondCS Process Guard Service Description Table Restoration Vulnerability
It is reported that the following tool, SDTrestore, may be used to exploit this vulnerability:
http://www.security.org.sg/code/sdtrestore.html
It is reported that the following tool, SDTrestore, may be used to exploit this vulnerability:
http://www.security.org.sg/code/sdtrestore.html
Solution / Fix
DiamondCS Process Guard Service Description Table Restoration Vulnerability
Solution:
It is reported that this vulnerability will be addressed by the vendor in the next release, this is not confirmed.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
It is reported that this vulnerability will be addressed by the vendor in the next release, this is not confirmed.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
DiamondCS Process Guard Service Description Table Restoration Vulnerability
References:
References:
- DiamondCS Process Guard Can Be Disabled by Direct Service Table Restoration (SIG^2 Vulnerability Research)
- ProcessGuard Homepage (DiamondCS)