Sign-up

ID

VAR-200610-0433


CVE

CVE-2006-5153


TITLE

Sunbelt Kerio Personal Firewall of fwdrv.sys Service disruption in drivers (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2006-002217

DESCRIPTION

The (1) fwdrv.sys and (2) khips.sys drivers in Sunbelt Kerio Personal Firewall 4.3.268 and earlier do not validate arguments passed through to SSDT functions, including NtCreateFile, NtDeleteFile, NtLoadDriver, NtMapViewOfSection, NtOpenFile, and NtSetInformationFile, which allows local users to cause a denial of service (crash) and possibly other impacts via unspecified vectors. Sunbelt Kerio Personal Firewall is prone to multiple local denial-of-service vulnerabilities because the application fails to properly sanitize user-supplied input. Exploiting these vulnerabilities allows local attackers to crash affected systems, facilitating a denial-of-service condition on the local computer. Code execution may also be possible, but this has not been confirmed. Sunbelt Kerio Personal Firewall hooks many functions in SSDT, at least 6 of them may not have parameters to authenticate user mode. Due to a bug in the fwdrv.sys and khips.sys drivers, calling NtCreateFile, NtDeleteFile, NtLoadDriver, NtMapViewOfSection, NtOpenFile, or NtSetInformationFile with invalid parameter values ​​can lead to a system crash. ---------------------------------------------------------------------- Want to work within IT-Security? Secunia is expanding its team of highly skilled security experts. We will help with relocation and obtaining a work permit. The vulnerabilities are caused due to errors within fwdrv.sys and khips.sys when handling the parameters of certain hooked functions. This can be exploited to cause a DoS by calling NtCreateFile, NtDeleteFile, NtLoadDriver, NtMapViewOfSection, NtOpenFile, and NtSetInformationFile with specially crafted parameters. The vulnerability has been reported in Kerio Personal Firewall 4.3.268, 4.3.246, 4.2.3.912. Other versions may also be affected. SOLUTION: Restrict access to trusted users only. PROVIDED AND/OR DISCOVERED BY: David Matousek ORIGINAL ADVISORY: http://www.matousec.com/info/advisories/Kerio-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.php ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2006-5153 // JVNDB: JVNDB-2006-002217 // BID: 20299 // VULHUB: VHN-21261 // PACKETSTORM: 50464

AFFECTED PRODUCTS

vendor:keriomodel:personal firewallscope:eqversion:4.0.8

Trust: 1.6

vendor:keriomodel:personal firewallscope:eqversion:4.0.16

Trust: 1.6

vendor:keriomodel:personal firewallscope:eqversion:4.0.7

Trust: 1.6

vendor:keriomodel:personal firewallscope:eqversion:4.0.12

Trust: 1.6

vendor:keriomodel:personal firewallscope:eqversion:4.0.13

Trust: 1.6

vendor:keriomodel:personal firewallscope:eqversion:4.0.10

Trust: 1.6

vendor:keriomodel:personal firewallscope:eqversion:4.0.6

Trust: 1.6

vendor:keriomodel:personal firewallscope:eqversion:4.0.11

Trust: 1.6

vendor:keriomodel:personal firewallscope:eqversion:4.0.14

Trust: 1.6

vendor:keriomodel:personal firewallscope:eqversion:4.0.15

Trust: 1.6

vendor:keriomodel:personal firewallscope:eqversion:4.3.268

Trust: 1.3

vendor:keriomodel:personal firewallscope:eqversion:4.3.246

Trust: 1.3

vendor:keriomodel:personal firewallscope:eqversion:4.1.1

Trust: 1.0

vendor:keriomodel:personal firewallscope:eqversion:4.1.2

Trust: 1.0

vendor:keriomodel:personal firewallscope:eqversion:4.0.9

Trust: 1.0

vendor:keriomodel:personal firewallscope:eqversion:4.1.0

Trust: 1.0

vendor:keriomodel:personal firewallscope:eqversion:4.2

Trust: 1.0

vendor:keriomodel:personal firewallscope:eqversion:4.1

Trust: 1.0

vendor:keriomodel:personal firewallscope:lteversion:4.3.268

Trust: 0.8

vendor:keriomodel:personal firewallscope:eqversion:4.2.3.912

Trust: 0.3

vendor:keriomodel:personal firewallscope:neversion:4.3.635

Trust: 0.3

sources: BID: 20299 // JVNDB: JVNDB-2006-002217 // CNNVD: CNNVD-200610-055 // NVD: CVE-2006-5153

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-5153
value: MEDIUM

Trust: 1.0

NVD: CVE-2006-5153
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200610-055
value: MEDIUM

Trust: 0.6

VULHUB: VHN-21261
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2006-5153
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-21261
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-21261 // JVNDB: JVNDB-2006-002217 // CNNVD: CNNVD-200610-055 // NVD: CVE-2006-5153

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-5153

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200610-055

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-200610-055

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2006-002217

PATCH
title:Sunbelt Kerio Personal Firewallurl:http://www.sunbeltsoftware.com/Home-Home-Office/Sunbelt-Personal-Firewall/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2006-002217

EXTERNAL IDS
db:NVDid:CVE-2006-5153
Trust: 2.8
db:BIDid:20299
Trust: 2.0
db:SECUNIAid:22234
Trust: 1.8
db:SREASONid:1685
Trust: 1.7
db:SECTRACKid:1016967
Trust: 1.7
db:VUPENid:ADV-2006-3872
Trust: 1.7
db:JVNDBid:JVNDB-2006-002217
Trust: 0.8
db:CNNVDid:CNNVD-200610-055
Trust: 0.7
db:BUGTRAQid:20061001 KERIO MULTIPLE INSUFFICIENT ARGUMENT VALIDATION OF HOOKED SSDT FUNCTION VULNERABILITY
Trust: 0.6
db:XFid:29313
Trust: 0.6
db:VULHUBid:VHN-21261
Trust: 0.1
db:PACKETSTORMid:50464
Trust: 0.1
sources:
            
            
            VULHUB: VHN-21261 // 
            
            
            
            BID: 20299 // 
            
            
            
            JVNDB: JVNDB-2006-002217 // 
            
            
            
            PACKETSTORM: 50464 // 
            
            
            
            CNNVD: CNNVD-200610-055 // 
            
            
            
            NVD: CVE-2006-5153

REFERENCES
url:http://www.matousec.com/info/advisories/kerio-multiple-insufficient-argument-validation-of-hooked-ssdt-functions.php
Trust: 2.1
url:http://www.securityfocus.com/bid/20299
Trust: 1.7
url:http://securitytracker.com/id?1016967
Trust: 1.7
url:http://secunia.com/advisories/22234
Trust: 1.7
url:http://securityreason.com/securityalert/1685
Trust: 1.7
url:http://www.securityfocus.com/archive/1/447504/100/0/threaded
Trust: 1.1
url:http://www.vupen.com/english/advisories/2006/3872
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/29313
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-5153
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-5153
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/447504/100/0/threaded
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/29313
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2006/3872
Trust: 0.6
url:http://www.sunbelt-software.com/kerio.cfm
Trust: 0.3
url:http://www.matousec.com/projects/windows-personal-firewall-analysis/plague-in-security-software-drivers.php
Trust: 0.3
url:/archive/1/447504
Trust: 0.3
url:/archive/1/479830
Trust: 0.3
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/quality_assurance_analyst/
Trust: 0.1
url:http://secunia.com/hardcore_disassembler_and_reverse_engineer/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/web_application_security_specialist/
Trust: 0.1
url:http://secunia.com/advisories/22234/
Trust: 0.1
url:http://secunia.com/product/2654/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-21261 // 
            
            
            
            BID: 20299 // 
            
            
            
            JVNDB: JVNDB-2006-002217 // 
            
            
            
            PACKETSTORM: 50464 // 
            
            
            
            CNNVD: CNNVD-200610-055 // 
            
            
            
            NVD: CVE-2006-5153

CREDITS
David Matousek david@matousec.com
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200610-055

SOURCES
db:VULHUBid:VHN-21261
db:BIDid:20299
db:JVNDBid:JVNDB-2006-002217
db:PACKETSTORMid:50464
db:CNNVDid:CNNVD-200610-055
db:NVDid:CVE-2006-5153

LAST UPDATE DATE
2024-08-14T15:31:00.715000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-21261date:2018-10-17T00:00:00
db:BIDid:20299date:2007-09-18T21:20:00
db:JVNDBid:JVNDB-2006-002217date:2012-09-25T00:00:00
db:CNNVDid:CNNVD-200610-055date:2006-10-09T00:00:00
db:NVDid:CVE-2006-5153date:2018-10-17T21:41:28.170

SOURCES RELEASE DATE
db:VULHUBid:VHN-21261date:2006-10-05T00:00:00
db:BIDid:20299date:2006-10-02T00:00:00
db:JVNDBid:JVNDB-2006-002217date:2012-09-25T00:00:00
db:PACKETSTORMid:50464date:2006-10-03T01:14:36
db:CNNVDid:CNNVD-200610-055date:2006-10-05T00:00:00
db:NVDid:CVE-2006-5153date:2006-10-05T04:04:00