BID:23579

Check Point Zone Alarm Srescan.SYS Multiple Local Privilege Escalation Vulnerabilities

Info

Check Point Zone Alarm Srescan.SYS Multiple Local Privilege Escalation Vulnerabilities

Bugtraq ID:	23579
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 20 2007 12:00AM
Updated:	Feb 11 2008 09:26PM
Credit:	Ruben Santamarta is credited with discovering these issues.
Vulnerable:	Zone Labs ZoneAlarm Security Suite 6.5.722 Zone Labs ZoneAlarm Security Suite 6.1.744 .000 Zone Labs ZoneAlarm Security Suite 6.1.737 Zone Labs ZoneAlarm Security Suite 5.5 .062.011 Zone Labs ZoneAlarm Security Suite 5.5 .062 Zone Labs ZoneAlarm Security Suite 5.5 Zone Labs ZoneAlarm Security Suite 5.1 Zone Labs ZoneAlarm Pro 6.0 Zone Labs ZoneAlarm Pro 5.5 .062.011 Zone Labs ZoneAlarm Pro 5.5 .062 Zone Labs ZoneAlarm Pro 5.1 Zone Labs ZoneAlarm Pro 5.0.590 .015 Zone Labs ZoneAlarm Pro 4.5 .538.001 Zone Labs ZoneAlarm Pro 4.5 Zone Labs ZoneAlarm Pro 4.0 Zone Labs ZoneAlarm Pro 3.1 Zone Labs ZoneAlarm Pro 3.0 Zone Labs ZoneAlarm Pro 2.6 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Zone Labs ZoneAlarm Pro 2.4 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Zone Labs ZoneAlarm Pro 7.0.302.000 Zone Labs ZoneAlarm Pro 6.5.737.000 Zone Labs ZoneAlarm Pro 6.1.744.001 Zone Labs ZoneAlarm Plus 4.5 .538.001 Zone Labs ZoneAlarm Plus 4.0 Zone Labs ZoneAlarm Internet Security Suite 6.0 Zone Labs ZoneAlarm for Windows XP 2.6 Zone Labs ZoneAlarm Antivirus 6.0 Zone Labs ZoneAlarm Antivirus Zone Labs ZoneAlarm Anti-Spyware 6.1 Zone Labs ZoneAlarm Anti-Spyware 6.0 Zone Labs ZoneAlarm 6.0 Zone Labs ZoneAlarm 5.5 .062.011 Zone Labs ZoneAlarm 5.1 Zone Labs ZoneAlarm 4.5 .538.001 Zone Labs ZoneAlarm 4.0 Zone Labs ZoneAlarm 3.7 .202 Zone Labs ZoneAlarm 3.1 Zone Labs ZoneAlarm 3.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Zone Labs ZoneAlarm 2.6 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Zone Labs ZoneAlarm 2.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Zone Labs ZoneAlarm 2.4 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Zone Labs ZoneAlarm 2.3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Zone Labs ZoneAlarm 2.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Zone Labs ZoneAlarm 2.1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0

Not Vulnerable:

Discussion

Check Point Zone Alarm Srescan.SYS Multiple Local Privilege Escalation Vulnerabilities

Check Point ZoneAlarm is prone to multiple local privilege-escalation vulnerabilities.

On a default installation, only certain restricted accounts can access the vulnerable sections of the application.

An attacker can exploit these issues to execute arbitrary code with SYSTEM-level privileges. A successful exploit will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition.

Check Point ZoneAlarm versions using ZoneAlarm Spyware Removal Engine (SRE) versions prior to 5.0.156.0 are vulnerable to this issue; other products using the vulnerable engine are reported vulnerable.

Exploit / POC

Check Point Zone Alarm Srescan.SYS Multiple Local Privilege Escalation Vulnerabilities

DSquare Security has developed a working commercial exploit for its D2 Exploitation Pack product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Solution / Fix

Check Point Zone Alarm Srescan.SYS Multiple Local Privilege Escalation Vulnerabilities

Solution:
Reports indicate that the vendor addressed these issues in versions 5.0.156.0 and higher of ZoneAlarm Spyware Removal Engine (SRE). Symantec has not confirmed this. Please contact the vendor for more information.

References

Check Point Zone Alarm Srescan.SYS Multiple Local Privilege Escalation Vulnerabilities

References:

Check Point Zone Labs SRESCAN IOCTL Local Privilege Escalation Vulnerability (iDefense Labs)
Zone Labs Homepage (Zone Labs)
CheckPoint Zonelabs - ZoneAlarm SRESCAN driver local privilege escalation (Rubén Santamarta)
Zone Alarm Homepage (Check Point )
ZoneAlarm Advisory (Srescan.sys) (Rubén Santamarta)