Kerio Personal Firewall Local Denial Of Service Vulnerability
BID:11859
Info
Kerio Personal Firewall Local Denial Of Service Vulnerability
| Bugtraq ID: | 11859 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 08 2004 12:00AM |
| Updated: | Dec 08 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to Cesar <[email protected]>. |
| Vulnerable: |
Kerio Personal Firewall 2 2.1.5 Kerio Personal Firewall 2 2.1.4 Kerio Personal Firewall 2 2.1.3 Kerio Personal Firewall 2 2.1.2 Kerio Personal Firewall 2 2.1.1 Kerio Personal Firewall 2 2.1 Kerio Personal Firewall 4.1.2 Kerio Personal Firewall 4.1.1 Kerio Personal Firewall 4.1 Kerio Personal Firewall 4.0.16 Kerio Personal Firewall 4.0.10 Kerio Personal Firewall 4.0.9 Kerio Personal Firewall 4.0.8 Kerio Personal Firewall 4.0.7 Kerio Personal Firewall 4.0.6 |
| Not Vulnerable: | |
Discussion
Kerio Personal Firewall Local Denial Of Service Vulnerability
It is reported that the Kerio Personal Firewall (KPF) driver does not sufficiently sanitize API parameters that are received from API's that are hooked by KPF. When the KPF API hook handles certain parameter data it will fail. Reports indicate that this exception is not expected and as a result, the Windows kernel crashes triggering a system wide denial of service.
A local attacker may exploit this vulnerability to deny service to legitimate users.
It is reported that the Kerio Personal Firewall (KPF) driver does not sufficiently sanitize API parameters that are received from API's that are hooked by KPF. When the KPF API hook handles certain parameter data it will fail. Reports indicate that this exception is not expected and as a result, the Windows kernel crashes triggering a system wide denial of service.
A local attacker may exploit this vulnerability to deny service to legitimate users.
Exploit / POC
Kerio Personal Firewall Local Denial Of Service Vulnerability
The following exploit is available:
The following exploit is available:
Solution / Fix
Kerio Personal Firewall Local Denial Of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.