WatchGuard ServerLock Unauthorized Kernel Module Loading Vulnerability

Bugtraq ID:	8222
Class:	Design Error
CVE:	CVE-2003-0641
Remote:	No
Local:	Yes
Published:	Jul 17 2003 12:00AM
Updated:	Jul 11 2009 10:56PM
Credit:	Reported by Jan K. Rutkowski <[email protected]>.
Vulnerable:	WatchGuard ServerLock 2.0.2 WatchGuard ServerLock 2.0.1 WatchGuard ServerLock 2.0
Not Vulnerable:	WatchGuard ServerLock 2.0.4 WatchGuard ServerLock 2.0.3

WatchGuard ServerLock Unauthorized Kernel Module Loading Vulnerability

WatchGuard ServerLock is prone to a vulnerability that may permit a malicious program to inject arbitrary code into trusted runtime processes, potentially allowing an arbitrary module to be loaded into the Windows 2000 kernel via the ZwSetSystemInformation() function. This could be exploited to circumvent the security provided by ServerLock.

This issue is reported to affects Windows 2000 systems.

WatchGuard ServerLock Unauthorized Kernel Module Loading Vulnerability

This discoverer of this vulnerability has claimed to have exploited this issue. Exploit code is not reported to be circulating in the wild at the time of writing.

WatchGuard ServerLock Unauthorized Kernel Module Loading Vulnerability

Solution:
WatchGuard has addressed this issue in ServerLock version 2.0.3 and later. For information on how to obtain patches, please visit the WatchGuard LiveSecurity website referenced below.

WatchGuard ServerLock Unauthorized Kernel Module Loading Vulnerability

References:

• LiveSecurity (WatchGuard)
  
• Product Web page (WatchGuard)
  
• Bypassing ServerLock protection on Windows 2000 (Jan Rutkowski )