Sunbelt Kerio Personal Firewall Multiple Local Denial of Service Vulnerabilities
BID:20299
Info
Sunbelt Kerio Personal Firewall Multiple Local Denial of Service Vulnerabilities
| Bugtraq ID: | 20299 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-5153 |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 02 2006 12:00AM |
| Updated: | Sep 18 2007 09:20PM |
| Credit: | David Matousek is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Kerio Personal Firewall 4.3.268 Kerio Personal Firewall 4.3.246 Kerio Personal Firewall 4.2.3 .912 |
| Not Vulnerable: |
Kerio Personal Firewall 4.3.635 |
Discussion
Sunbelt Kerio Personal Firewall Multiple Local Denial of Service Vulnerabilities
Sunbelt Kerio Personal Firewall is prone to multiple local denial-of-service vulnerabilities because the application fails to properly sanitize user-supplied input.
Exploiting these vulnerabilities allows local attackers to crash affected systems, facilitating a denial-of-service condition on the local computer. Code execution may also be possible, but this has not been confirmed.
Sunbelt Kerio Personal Firewall is prone to multiple local denial-of-service vulnerabilities because the application fails to properly sanitize user-supplied input.
Exploiting these vulnerabilities allows local attackers to crash affected systems, facilitating a denial-of-service condition on the local computer. Code execution may also be possible, but this has not been confirmed.
Exploit / POC
Sunbelt Kerio Personal Firewall Multiple Local Denial of Service Vulnerabilities
The following proof-of-concept code demonstrates this issue:
The following proof-of-concept code demonstrates this issue:
Solution / Fix
Sunbelt Kerio Personal Firewall Multiple Local Denial of Service Vulnerabilities
Solution:
The vendor has addressed this issue in Kerio Personal Firewall 4.3.635. Contact the vendor for details on obtaining and applying the appropriate updates.
Solution:
The vendor has addressed this issue in Kerio Personal Firewall 4.3.635. Contact the vendor for details on obtaining and applying the appropriate updates.
References
Sunbelt Kerio Personal Firewall Multiple Local Denial of Service Vulnerabilities
References:
References:
- Kerio Multiple insufficient argument validation of hooked SSDT function Vulnerab (Matousec)
- Kerio Personal Firewall Home Page (Kerio)
- Windows Personal Firewall Analysis (Matousec)
- Kerio Multiple insufficient argument validation of hooked SSDT function Vulnerab (David Matousek
- Plague in (security) software drivers & BSDOhook utility (Matousec)