Online Armor Personal Firewall IOCTL Request Local Privilege Escalation Vulnerability

Bugtraq ID:	35227
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 04 2009 12:00AM
Updated:	Jun 05 2009 04:29PM
Credit:	NT Internals
Vulnerable:	Online Armor Personal Firewall AV+ 0 Online Armor Personal Firewall 3.5 .12 Online Armor Personal Firewall 2.0.1.215
Not Vulnerable:

Online Armor Personal Firewall IOCTL Request Local Privilege Escalation Vulnerability

Online Armor Personal Firewall is prone to a local privilege-escalation vulnerability.

An attacker may exploit this issue to execute arbitrary code with elevated privileges, which may facilitate a complete compromise of the affected computer.

Online Armor Personal Firewall 3.5.0.12 and prior versions are affected. Online Armor Personal Firewall AV+ is also vulnerable.

Online Armor Personal Firewall IOCTL Request Local Privilege Escalation Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/35227.zip

Online Armor Personal Firewall IOCTL Request Local Privilege Escalation Vulnerability

Solution:
Reports indicate that the vendor has released fixes for this issue, but Symantec has not verified this information.

If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Online Armor Personal Firewall IOCTL Request Local Privilege Escalation Vulnerability

References:

• Advisory NTIADV0806 Online Armor (OAmon.sys) Multiple Privilege Escalation Vulne (NT Internals)
  
• Online Armor Personal Firewall Homepage (Online Armor)