DiamondCS ProcessGuard SSDT Hooks Multiple Local Vulnerabilities

Bugtraq ID:	25714
Class:	Boundary Condition Error
CVE:	CVE-2007-4970
Remote:	No
Local:	Yes
Published:	Sep 18 2007 12:00AM
Updated:	May 07 2015 05:35PM
Credit:	Matousec Transparent Security Research discovered these vulnerabilities.
Vulnerable:	DiamondCS ProcessGuard 0.9.9
Not Vulnerable:

DiamondCS ProcessGuard SSDT Hooks Multiple Local Vulnerabilities

ProcessGuard is prone to multiple local vulnerabilities.

Exploiting these vulnerabilities allows local attackers to crash affected computers, denying service to legitimate users. Attackers might also be able to gain elevated privileges by executing arbitrary machine code in the context of the kernel, but this has not been confirmed.

ProcessGuard 3.410 is vulnerable; other versions may also be affected.

DiamondCS ProcessGuard SSDT Hooks Multiple Local Vulnerabilities

To exploit these issues, attackers can use 'BSODhook' from Matousec.

DiamondCS ProcessGuard SSDT Hooks Multiple Local Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error
or if you are aware of more recent information, please mail us at: [email protected].

DiamondCS ProcessGuard SSDT Hooks Multiple Local Vulnerabilities

References:

• ProcessGuard Homepage (DiamondCS)
  
• Windows Personal Firewall Analysis (Matousec)
  
• Plague in (security) software drivers & BSDOhook utility (Matousec)