Sign-up

ID

VAR-200704-0313


CVE

CVE-2007-2174


TITLE

Check Point ZoneAlarm of ZoneAlarm SRE Vulnerable to arbitrary file execution

Trust: 0.8

sources: JVNDB: JVNDB-2007-001861

DESCRIPTION

The IOCTL handling in srescan.sys in the ZoneAlarm Spyware Removal Engine (SRE) in Check Point ZoneAlarm before 5.0.156.0 allows local users to execute arbitrary code via certain IOCTL lrp parameter addresses. Check Point ZoneAlarm is prone to multiple local privilege-escalation vulnerabilities. On a default installation, only certain restricted accounts can access the vulnerable sections of the application. An attacker can exploit these issues to execute arbitrary code with SYSTEM-level privileges. A successful exploit will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition. ZoneAlarm is a personal computer firewall that protects personal data and privacy. There is a vulnerability in ZoneAlarm's srescan.sys driver implementation. Local attackers may use this vulnerability to elevate their privileges in the system. The IOCTL handling code of the srescan.sys device driver does not correctly handle userland addresses passed to IOCTL 0x22208F and IOCTL 0x2220CF. In the case of IOCTL 0x2220CF, the attacker can write the constant double word value 0x30000; in the case of IOCTL 0x22208F, the attacker can write the contents of the ZwQuerySystemInformation return buffer. ---------------------------------------------------------------------- Secunia customers receive relevant and filtered advisories. Delivery is done via different channels including SMS, Email, Web, and https based XML feed. http://corporate.secunia.com/trial/38/request/ ---------------------------------------------------------------------- TITLE: ZoneAlarm Products SRESCAN.SYS IOCTL Handler Privilege Escalation SECUNIA ADVISORY ID: SA24986 VERIFY ADVISORY: http://secunia.com/advisories/24986/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system SOFTWARE: ZoneAlarm 4.x http://secunia.com/product/150/ ZoneAlarm 3.x http://secunia.com/product/153/ ZoneAlarm 2.x http://secunia.com/product/3056/ ZoneAlarm 5.x http://secunia.com/product/4647/ ZoneAlarm 6.x http://secunia.com/product/5806/ ZoneAlarm 7.x http://secunia.com/product/13889/ ZoneAlarm Anti-Spyware 6.x http://secunia.com/product/6073/ ZoneAlarm Antivirus 5.x http://secunia.com/product/4271/ ZoneAlarm Antivirus 6.x http://secunia.com/product/6074/ ZoneAlarm Internet Security Suite 6.x http://secunia.com/product/6072/ ZoneAlarm Plus 3.x http://secunia.com/product/3057/ ZoneAlarm Plus 4.x http://secunia.com/product/151/ ZoneAlarm Pro 2.x http://secunia.com/product/152/ ZoneAlarm Pro 3.x http://secunia.com/product/1960/ ZoneAlarm Pro 4.x http://secunia.com/product/1961/ ZoneAlarm Pro 5.x http://secunia.com/product/4280/ ZoneAlarm Pro 6.x http://secunia.com/product/6071/ ZoneAlarm Security Suite 5.x http://secunia.com/product/4272/ ZoneAlarm Wireless Security 5.x http://secunia.com/product/4648/ DESCRIPTION: Some vulnerabilities have been reported in ZomeAlarm products, which can be exploited by malicious, local users to gain escalated privileges. Insufficient address space verification within the 0x22208F and 0x0x2220CF IOCTL handlers of SRESCAN.SYS and insecure permissions on the \\.\SreScan DOS device interface can be exploited to e.g. The vulnerabilities are reported in SRESCAN.SYS version 5.0.63.0 included in the free version of ZoneAlarm. Other versions may also be affected. SOLUTION: Update to version 5.0.156.0 or higher of the ZoneAlarm Spyware Removal Engine (current deployed version is 5.0.162.0). http://www.zonealarm.com/store/content/catalog/download_buy.jsp?dc=12bms&ctry=US&lang=en PROVIDED AND/OR DISCOVERED BY: Discovered by Ruben Santamarta and reported via iDefense Labs. ORIGINAL ADVISORY: iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=517 Reversemode: http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=48 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2007-2174 // JVNDB: JVNDB-2007-001861 // BID: 23579 // VULHUB: VHN-25536 // PACKETSTORM: 56156

AFFECTED PRODUCTS

vendor:checkpointmodel:zonealarmscope:lteversion:5.0.63.0

Trust: 1.0

vendor:check pointmodel:zonealarmscope:ltversion:5.0.156.0

Trust: 0.8

vendor:checkpointmodel:zonealarmscope:eqversion:5.0.63.0

Trust: 0.6

vendor:zonemodel:labs zonealarm security suitescope:eqversion:6.5.722

Trust: 0.3

vendor:zonemodel:labs zonealarm security suitescope:eqversion:6.1.744.000

Trust: 0.3

vendor:zonemodel:labs zonealarm security suitescope:eqversion:6.1.737

Trust: 0.3

vendor:zonemodel:labs zonealarm security suitescope:eqversion:5.5.062.011

Trust: 0.3

vendor:zonemodel:labs zonealarm security suitescope:eqversion:5.5.062

Trust: 0.3

vendor:zonemodel:labs zonealarm security suitescope:eqversion:5.5

Trust: 0.3

vendor:zonemodel:labs zonealarm security suitescope:eqversion:5.1

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:6.0

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:5.5.062.011

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:5.5.062

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:5.1

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:5.0.590.015

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:4.5.538.001

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:4.5

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:4.0

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:3.1

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:3.0

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:2.6

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:2.4

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:7.0.302.000

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:6.5.737.000

Trust: 0.3

vendor:zonemodel:labs zonealarm proscope:eqversion:6.1.744.001

Trust: 0.3

vendor:zonemodel:labs zonealarm plusscope:eqversion:4.5.538.001

Trust: 0.3

vendor:zonemodel:labs zonealarm plusscope:eqversion:4.0

Trust: 0.3

vendor:zonemodel:labs zonealarm internet security suitescope:eqversion:6.0

Trust: 0.3

vendor:zonemodel:labs zonealarm for windows xpscope:eqversion:2.6

Trust: 0.3

vendor:zonemodel:labs zonealarm antivirusscope:eqversion:6.0

Trust: 0.3

vendor:zonemodel:labs zonealarm antivirusscope: - version: -

Trust: 0.3

vendor:zonemodel:labs zonealarm anti-spywarescope:eqversion:6.1

Trust: 0.3

vendor:zonemodel:labs zonealarm anti-spywarescope:eqversion:6.0

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:6.0

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:5.5.062.011

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:5.1

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:4.5.538.001

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:4.0

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:3.7.202

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:3.1

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:3.0

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:2.6

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:2.5

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:2.4

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:2.3

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:2.2

Trust: 0.3

vendor:zonemodel:labs zonealarmscope:eqversion:2.1

Trust: 0.3

sources: BID: 23579 // JVNDB: JVNDB-2007-001861 // CNNVD: CNNVD-200704-453 // NVD: CVE-2007-2174

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2007-2174
value: HIGH

Trust: 1.0

NVD: CVE-2007-2174
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200704-453
value: HIGH

Trust: 0.6

VULHUB: VHN-25536
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2007-2174
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-25536
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-25536 // JVNDB: JVNDB-2007-001861 // CNNVD: CNNVD-200704-453 // NVD: CVE-2007-2174

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2007-2174

THREAT TYPE

local

Trust: 1.0

sources: BID: 23579 // PACKETSTORM: 56156 // CNNVD: CNNVD-200704-453

TYPE

Design Error

Trust: 0.9

sources: BID: 23579 // CNNVD: CNNVD-200704-453

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2007-001861

PATCH
title:Top Pageurl:http://www.checkpoint.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2007-001861

EXTERNAL IDS
db:NVDid:CVE-2007-2174
Trust: 2.5
db:BIDid:23579
Trust: 2.0
db:SECUNIAid:24986
Trust: 1.8
db:SECTRACKid:1017953
Trust: 1.7
db:SECTRACKid:1017948
Trust: 1.7
db:VUPENid:ADV-2007-1491
Trust: 1.7
db:JVNDBid:JVNDB-2007-001861
Trust: 0.8
db:CNNVDid:CNNVD-200704-453
Trust: 0.7
db:BUGTRAQid:20070423 [REVERSEMODE ADVISORY] CHECKPOINT ZONELABS - ZONEALARM SRESCAN DRIVER LOCAL PRIVILEGE ESCALATION
Trust: 0.6
db:IDEFENSEid:20070420 CHECK POINT ZONE LABS SRESCAN IOCTL LOCAL PRIVILEGE ESCALATION VULNERABILITY
Trust: 0.6
db:XFid:33786
Trust: 0.6
db:VULHUBid:VHN-25536
Trust: 0.1
db:PACKETSTORMid:56156
Trust: 0.1
sources:
            
            
            VULHUB: VHN-25536 // 
            
            
            
            BID: 23579 // 
            
            
            
            JVNDB: JVNDB-2007-001861 // 
            
            
            
            PACKETSTORM: 56156 // 
            
            
            
            CNNVD: CNNVD-200704-453 // 
            
            
            
            NVD: CVE-2007-2174

REFERENCES
url:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=517
Trust: 2.1
url:http://www.securityfocus.com/bid/23579
Trust: 1.7
url:http://www.securitytracker.com/id?1017948
Trust: 1.7
url:http://www.securitytracker.com/id?1017953
Trust: 1.7
url:http://secunia.com/advisories/24986
Trust: 1.7
url:http://www.securityfocus.com/archive/1/466656/100/0/threaded
Trust: 1.1
url:http://www.vupen.com/english/advisories/2007/1491
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/33786
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-2174
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-2174
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/33786
Trust: 0.6
url:http://www.securityfocus.com/archive/1/archive/1/466656/100/0/threaded
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2007/1491
Trust: 0.6
url:http://www.zonelabs.com
Trust: 0.3
url:/archive/1/466656
Trust: 0.3
url:http://www.zonealarm.com
Trust: 0.3
url:http://www.reversemode.com/index.php?option=com_remository&itemid=2&func=download&id=48&chk=bab5257f3ee1107ea201a3a76f1e4c01
Trust: 0.3
url:http://secunia.com/product/4272/
Trust: 0.1
url:http://secunia.com/product/150/
Trust: 0.1
url:http://www.zonealarm.com/store/content/catalog/download_buy.jsp?dc=12bms&ctry=us&lang=en
Trust: 0.1
url:http://secunia.com/product/3057/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/product/4647/
Trust: 0.1
url:http://www.reversemode.com/index.php?option=com_remository&itemid=2&func=fileinfo&id=48
Trust: 0.1
url:http://secunia.com/product/4280/
Trust: 0.1
url:http://secunia.com/product/1960/
Trust: 0.1
url:http://secunia.com/product/151/
Trust: 0.1
url:http://secunia.com/product/152/
Trust: 0.1
url:http://secunia.com/product/5806/
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/product/6072/
Trust: 0.1
url:http://secunia.com/product/1961/
Trust: 0.1
url:http://secunia.com/product/6074/
Trust: 0.1
url:http://secunia.com/product/153/
Trust: 0.1
url:http://corporate.secunia.com/trial/38/request/
Trust: 0.1
url:http://secunia.com/product/6073/
Trust: 0.1
url:http://secunia.com/product/4271/
Trust: 0.1
url:http://secunia.com/product/13889/
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/product/4648/
Trust: 0.1
url:http://secunia.com/product/6071/
Trust: 0.1
url:http://secunia.com/product/3056/
Trust: 0.1
url:http://secunia.com/advisories/24986/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-25536 // 
            
            
            
            BID: 23579 // 
            
            
            
            JVNDB: JVNDB-2007-001861 // 
            
            
            
            PACKETSTORM: 56156 // 
            
            
            
            CNNVD: CNNVD-200704-453 // 
            
            
            
            NVD: CVE-2007-2174

CREDITS
Ruben Santamarta  ruben@reversemode.com
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200704-453

SOURCES
db:VULHUBid:VHN-25536
db:BIDid:23579
db:JVNDBid:JVNDB-2007-001861
db:PACKETSTORMid:56156
db:CNNVDid:CNNVD-200704-453
db:NVDid:CVE-2007-2174

LAST UPDATE DATE
2024-11-23T22:54:05.402000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-25536date:2018-10-16T00:00:00
db:BIDid:23579date:2008-02-11T21:26:00
db:JVNDBid:JVNDB-2007-001861date:2012-06-26T00:00:00
db:CNNVDid:CNNVD-200704-453date:2007-04-24T00:00:00
db:NVDid:CVE-2007-2174date:2024-11-21T00:30:05.957

SOURCES RELEASE DATE
db:VULHUBid:VHN-25536date:2007-04-24T00:00:00
db:BIDid:23579date:2007-04-20T00:00:00
db:JVNDBid:JVNDB-2007-001861date:2012-06-26T00:00:00
db:PACKETSTORMid:56156date:2007-04-23T14:27:41
db:CNNVDid:CNNVD-200704-453date:2007-04-24T00:00:00
db:NVDid:CVE-2007-2174date:2007-04-24T16:19:00