Kerio Personal Firewall and Kerio Server Firewall FWDRV driver Local Denial of Service

2005.10.14
Credit: Piotr Bania
Risk: Low
Local: Yes
Remote: No
CWE: N/A


CVSS Base Score: 2.1/10
Impact Subscore: 2.9/10
Exploitability Subscore: 3.9/10
Exploit range: Local
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Partial

Kerio Technologies Kerio Personal Firewall and Kerio Server Firewall FWDRV driver Local denial of service by Piotr Bania <bania.piotr (at) gmail (dot) com [email concealed]> http://pb.specialised.info Original location: http://pb.specialised.info/all/adv/kerio-fwdrv-dos-adv.txt Severity: Low (local machine denial of service - BSOD) Software affected: Tested on Kerio Personal Firewall 4 (4.2.0) and KerioServerFirewall version 1.1.1, however it is highly possible that earlier versions are also vulnerable. I. BACKGROUND From kerio.com website: "Kerio Personal Firewall represents smart, easy-to-use personal security technology that fully protects personal computers against hackers and internal misuse" "Kerio ServerFirewall offers IT and security administrators a powerful and easy-to-use tool to protect their server systems from worms, buffer-overflow and other internet security threats." II. DESCRIPTION FWDRV driver (core part of the firewall system) monitors all programs that are trying to connect to the internet. While doing necessary checks, FWDRV parses the Process Environment Block (PEB) like the code shows: ;----------SNIP-------------------------------------------- .text:0041C04E mov ecx, [ebp+var_4] ; ECX = PEB base .text:0041C051 mov edx, [ecx+0Ch] ; EDX = PEB_LDR_DATA ;----------SNIP-------------------------------------------- However while parsing the PEB FWDRV doesn't check if the memory with Process Environment Block is accessible. It means that if attacker will set PAGE_NOACCESS or PAGE_GUARD protection to the PEB block the FWDRV will cause an fatal exception and the machine will crash. III. IMPACT Sample scenario: Executing connect api function with previously PAGE_NOACCESS protection set to Process Environment Block will cause an local machine crash. IV. POC CODE Sample POC code was released to vendor. best regards, Piotr Bania -- -------------------------------------------------------------------- Piotr Bania - <bania.piotr (at) gmail (dot) com [email concealed]> - 0xCD, 0x19 Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33 http://pb.specialised.info - Key ID: 0xBE43AC33 --------------------------------------------------------------------


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top