TITLE:
Webroot Desktop Firewall Two Vulnerabilities

SECUNIA ADVISORY ID:
SA15745

VERIFY ADVISORY:
http://secunia.com/advisories/15745/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Privilege escalation

WHERE:
Local system

SOFTWARE:
Webroot Desktop Firewall 1.x
http://secunia.com/product/5805/

DESCRIPTION:
Secunia Research has discovered two vulnerabilities in Webroot
Desktop Firewall, which can be exploited by malicious, local users to
gain escalated privileges or bypass certain security restrictions.

1) A boundary error in PWIWrapper.dll when deleting a program from
the list of "allowed" programs can cause a stack-based buffer
overflow in FirewallNTService.exe. This can be exploited by sending a
specially crafted application chain to the firewall driver via a
DeviceIoControl() command, and then removing an "allowed" program
from the firewall GUI.

Successful exploitation allows non-privileged users to execute
arbitrary code with SYSTEM privileges, but requires the the ability
to add and remove programs from the firewall's permitted application
list.

2) It is possible for non-privileged users to disable the firewall
even when password protection has been enabled, by sending specific
DeviceIoControl() commands to the firewall driver.

The vulnerabilities have been confirmed in version 1.3.0 build 43.
Other versions may also be affected.

SOLUTION:
Update to version 1.3.0 build 52.

PROVIDED AND/OR DISCOVERED BY:
Tan Chew Keong, Secunia Research.

ORIGINAL ADVISORY:
Webroot:
http://support.webroot.com/ics/support/KBAnswer.asp?questionID=2332

Secunia Research:
http://secunia.com/secunia_research/2005-10/advisory/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------