Kerio Personal Firewall IPHLPAPI.DLL Local Privilege Escalation Vulnerability

Bugtraq ID:	21828
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 01 2007 12:00AM
Updated:	Jan 04 2007 06:28PM
Credit:	Matousec - Transparent security Research is credited with the discovery of this vulnerability.
Vulnerable:	Sunbelt Software Kerio Personal Firewall 4.3.468 Sunbelt Software Kerio Personal Firewall 4.3.426
Not Vulnerable:

Kerio Personal Firewall IPHLPAPI.DLL Local Privilege Escalation Vulnerability

Kerio Personal Firewall is prone to a local privilege-escalation vulnerability.

A local attacker could exploit this issue to execute arbitrary machine code with SYSTEM-level privileges. A successful exploit could result in the complete compromise of the affected computer.

Versions 4.3.246 and 4.3.268 are vulnerable to this issue; other versions may also be affected.

Kerio Personal Firewall IPHLPAPI.DLL Local Privilege Escalation Vulnerability

The following exploit is available to demonstrate this issue:

• /data/vulnerabilities/exploits/BTP00002P001SK.zip

Kerio Personal Firewall IPHLPAPI.DLL Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Kerio Personal Firewall IPHLPAPI.DLL Local Privilege Escalation Vulnerability

References:

• Kerio Fake 'iphlpapi' DLL injection Vulnerability (Matousec)
  
• Kerio Personal Firewall Home Page (Kerio)
  
• Kerio Fake 'iphlpapi' DLL injection Vulnerability (Matousec - Transparent security Research )