ID

VAR-200502-0086

CVE

CVE-2005-0114

TITLE

ZoneAlarm 5.1 Illegal pointer discards local denial of service vulnerability

DESCRIPTION

vsdatant.sys in Zone Lab ZoneAlarm before 5.5.062.011, ZoneAlarm Wireless before 5.5.080.000, Check Point Integrity Client 4.x before 4.5.122.000 and 5.x before 5.1.556.166 do not properly verify that the ServerPortName argument to the NtConnectPort function is a valid memory address, which allows local users to cause a denial of service (system crash) when ZoneAlarm attempts to dereference an invalid pointer. Multiple ZoneAlarm products and Check Point Integrity Client are reported prone to a local denial of service vulnerability. This issue exists due to an invalid pointer dereference. A successful attack can result in a denial of service condition in the kernel. ZoneAlarm Security Suite, ZoneAlarm Pro, and ZoneAlarm versions prior to 5.5.062.011 and Check Point Integrity Client versions prior to 4.5.122.000 and 5.1.556.166 are considered vulnerable to this issue. ZoneAlarm is a popular desktop firewall system. BACKGROUND Zone Labs ZoneAlarm provides personal firewall protection. More information is available from: http://www.zonelabs.com/ II. ZoneAlarm offers process specific protection by hooking the kernel API routine NtConnectPort(). NtConnectPort() is used by programs to implement advanced inter-process communication (IPC). The NtConnectPort() function is declared as follows: NtConnectPort( OUT PHANDLE ClientPortHandle, IN PUNICODE_STRING ServerPortName, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, IN OUT PLPC_SECTION_OWNER_MEMORY ClientSharedMemory OPTIONAL, OUT PLPC_SECTION_MEMORY ServerSharedMemory OPTIONAL, OUT PULONG MaximumMessageLength OPTIONAL, IN OUT PVOID ConnectionInfo OPTIONAL, IN OUT PULONG ConnectionInfoLength OPTIONAL); The problem specifically exists within vsdatant.sys as ZoneAlarm fails to verify the second argument. 'ServerPortName' is a valid address prior to derefencing it as a pointer. The vulnerable section of code is displayed here: 0001EE93 mov esi, [esp+108h+ServerPortName] 0001EE9A mov edi, eax 0001EE9C test esi, esi 0001EE9E jz short loc_1EEB6 0001EEA0 mov edx, [esi+4] The argument 'ServerPortName' is stored in the register ESI. A check is made to ensure that the value is not NULL. Any non-zero invalid memory address can be passed as the second argument to NtConnectPort(), resulting in a system crash. III. ANALYSIS Exploitation allows local and remote attackers who have exploited another vulnerability to trigger a DoS in kernel space, resulting in a "blue screen of death." IV. DETECTION iDEFENSE has confirmed the existence of this vulnerability in ZoneAlarm version 5.1. It is suspected that previous versions of ZoneAlarm are vulnerable as well. V. WORKAROUND iDEFENSE is currently unaware of any workarounds for this issue. VI. VENDOR RESPONSE A vendor advisory for this issue is available at: http://download.zonelabs.com/bin/free/securityAlert/19.html VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the names CAN-2005-0114 to these issues. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 01/06/2005 Initial vendor notification 01/07/2005 Initial vendor response 02/11/2005 Coordinated public disclosure IX. CREDIT iDEFENSE Labs is credited with this discovery. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

Design Error

EXPLOIT AVAILABILITY

EXTERNAL IDS

REFERENCES

CREDITS

Discovery is credited to iDEFENSE Labs.

SOURCES

LAST UPDATE DATE

2024-08-14T15:45:43.244000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE