ID
VAR-200510-0113
CVE
CVE-2005-3286
TITLE
Kerio Personal firewall and server firewall PEB lockout Denial of service vulnerability
Trust: 0.6
DESCRIPTION
The FWDRV driver in Kerio Personal Firewall 4.2 and Server Firewall 1.1.1 allows local users to cause a denial of service (crash) by setting the PAGE_NOACCESS or PAGE_GUARD protection on the Page Environment Block (PEB), which triggers an exception, aka the "PEB lockout vulnerability.". Kerio Personal Firewall and ServerFirewall are prone to a local denial of service vulnerability. Reports indicate that the FWDRV driver does not verify access to memory associated with the Process Environment Block (PEB) of the application. An attacker can trigger fatal exceptions and cause the firewall process to terminate. A denial of service condition in the firewall can expose computers to further attacks. Kerio Personal Firewall and Server Firewall are easy-to-use firewall products. Kerio Personal Firewall and Server Firewall are easy-to-use firewall products. When parsing the PEB, FWDRV does not check whether the memory is accessible, that is to say, if the attacker can set PAGE_NOACCESS or PAGE_GUARD protection on the PEB, it will cause an exception and the machine will blue screen of death. This can be exploited to crash the system via a malicious application that locks the memory page where its PEB resides before connecting to the network. * Kerio ServerFirewall version 1.1.1 and prior. SOLUTION: Kerio Personal Firewall: Update to version 4.2.1 or later. Kerio ServerFirewall: Update to version 1.1.2 or later. PROVIDED AND/OR DISCOVERED BY: Piotr Bania ORIGINAL ADVISORY: Kerio: http://www.kerio.com/security_advisory.html Piotr Bania: http://pb.specialised.info/all/adv/kerio-fwdrv-dos-adv.txt ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
Trust: 1.35
AFFECTED PRODUCTS
| vendor: | kerio | model: | serverfirewall | scope: | eq | version: | 1.1.1 | Trust: 1.9 |
| vendor: | kerio | model: | personal firewall | scope: | eq | version: | 4.2 | Trust: 1.9 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | NVD-CWE-Other | Trust: 1.0 |
THREAT TYPE
local
Trust: 1.0
TYPE
other
Trust: 0.6
EXTERNAL IDS
| db: | BID | id: | 15094 | Trust: 2.0 |
| db: | SECUNIA | id: | 17155 | Trust: 1.8 |
| db: | OSVDB | id: | 19961 | Trust: 1.7 |
| db: | NVD | id: | CVE-2005-3286 | Trust: 1.7 |
| db: | SREASON | id: | 78 | Trust: 1.7 |
| db: | CNNVD | id: | CNNVD-200510-180 | Trust: 0.7 |
| db: | FULLDISC | id: | 20051013 KERIO PERSONAL FIREWALL AND KERIO SERVER FIREWALL FWDRV DRIVER LOCAL DENIAL OF SERVICE | Trust: 0.6 |
| db: | VULHUB | id: | VHN-14495 | Trust: 0.1 |
| db: | PACKETSTORM | id: | 40706 | Trust: 0.1 |
REFERENCES
| url: | http://www.kerio.com/security_advisory.html | Trust: 1.8 |
| url: | http://pb.specialised.info/all/adv/kerio-fwdrv-dos-adv.txt | Trust: 1.8 |
| url: | http://www.securityfocus.com/bid/15094 | Trust: 1.7 |
| url: | http://lists.grok.org.uk/pipermail/full-disclosure/2005-october/037958.html | Trust: 1.7 |
| url: | http://www.osvdb.org/19961 | Trust: 1.7 |
| url: | http://secunia.com/advisories/17155 | Trust: 1.7 |
| url: | http://securityreason.com/securityalert/78 | Trust: 1.7 |
| url: | http://seclists.org/bugtraq/2005/oct/166 | Trust: 1.1 |
| url: | http://www.kerio.com | Trust: 0.3 |
| url: | /archive/1/413253 | Trust: 0.3 |
| url: | http://secunia.com/product/1493/ | Trust: 0.1 |
| url: | http://secunia.com/secunia_security_advisories/ | Trust: 0.1 |
| url: | http://secunia.com/advisories/17155/ | Trust: 0.1 |
| url: | http://secunia.com/product/2653/ | Trust: 0.1 |
| url: | http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org | Trust: 0.1 |
| url: | http://secunia.com/product/4378/ | Trust: 0.1 |
| url: | http://secunia.com/about_secunia_advisories/ | Trust: 0.1 |
| url: | http://secunia.com/product/2654/ | Trust: 0.1 |
CREDITS
Piotr Bania bania.piotr@gmail.com
Trust: 0.6
SOURCES
| db: | VULHUB | id: | VHN-14495 |
| db: | BID | id: | 15094 |
| db: | PACKETSTORM | id: | 40706 |
| db: | CNNVD | id: | CNNVD-200510-180 |
| db: | NVD | id: | CVE-2005-3286 |
LAST UPDATE DATE
2024-08-14T15:15:00.506000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-14495 | date: | 2012-12-13T00:00:00 |
| db: | BID | id: | 15094 | date: | 2005-10-13T00:00:00 |
| db: | CNNVD | id: | CNNVD-200510-180 | date: | 2012-12-26T00:00:00 |
| db: | NVD | id: | CVE-2005-3286 | date: | 2012-12-13T02:43:26.673 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-14495 | date: | 2005-10-23T00:00:00 |
| db: | BID | id: | 15094 | date: | 2005-10-13T00:00:00 |
| db: | PACKETSTORM | id: | 40706 | date: | 2005-10-14T22:19:03 |
| db: | CNNVD | id: | CNNVD-200510-180 | date: | 2005-10-23T00:00:00 |
| db: | NVD | id: | CVE-2005-3286 | date: | 2005-10-23T10:02:00 |