exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

CAID-hips.txt

CAID-hips.txt
Posted Aug 13, 2008
Authored by Ken Williams | Site www3.ca.com

The Computer Associates Host-Based Intrusion Prevention System SDK contains two vulnerabilities that can allow an attacker to cause a denial of service or possibly execute arbitrary code. CA has issued updates to address the vulnerabilities. The first vulnerability occurs due to insufficient verification of IOCTL requests by the kmxfw.sys driver. A local attacker can send an IOCTL request that can cause a system crash or potentially result in arbitrary code execution. The second vulnerability occurs due to insufficient validation by the kmxfw.sys driver. An attacker can make a request that can cause a system crash.

tags | advisory, denial of service, arbitrary, local, vulnerability, code execution
advisories | CVE-2008-2926, CVE-2008-3174
SHA-256 | 985be0e793f4ac4d6d9e3779bf5ca6b54567e5ea355a83dec5b7ae1dbd4feee5

CAID-hips.txt

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Title: CA Host-Based Intrusion Prevention System SDK kmxfw.sys
Multiple Vulnerabilities


CA Advisory Date: 2008-08-11


Reported By:
CVE-2008-2926 - Tobias Klein
CVE-2008-3174 - Elazar Broad


Impact: A remote attacker can cause a denial of service or
possibly execute arbitrary code.


Summary: CA Host-Based Intrusion Prevention System SDK contains
two vulnerabilities that can allow an attacker to cause a denial
of service or possibly execute arbitrary code. CA has issued
updates to address the vulnerabilities. The first vulnerability,
CVE-2008-2926, occurs due to insufficient verification of IOCTL
requests by the kmxfw.sys driver. A local attacker can send an
IOCTL request that can cause a system crash or potentially result
in arbitrary code execution. The second vulnerability,
CVE-2008-3174, occurs due to insufficient validation by the
kmxfw.sys driver. An attacker can make a request that can cause a
system crash.


Mitigating Factors: None


Severity: CA has given these vulnerabilities a Medium risk rating.


Affected Products:
CA Host-Based Intrusion Prevention System r8
CA Internet Security Suite 2007 (v3.2) with CA Personal Firewall
2007 (v9.1) Engine version 1.2.260 and below
CA Internet Security Suite 2008 (v4.0) with CA Personal Firewall
2008 (v10.0) Engine version 1.2.260 and below
CA Personal Firewall 2007 (v9.1) with Engine version 1.2.260 and
below
CA Personal Firewall 2008 (v10.0) with Engine version 1.2.260 and
below


Affected Platforms:
Windows


Status and Recommendation:
CA has issued the following updates to address the vulnerabilities.

CA Host-Based Intrusion Prevention System r8:
RO00535
https://support.ca.com/irj/portal/anonymous/redirArticles?reqPage=search&se
archID=RO00535

CA Internet Security Suite r3, r4 and CA Personal Firewall 2007,
2008:
Ensure the latest engine is installed by using the built-in update
mechanism. CA Personal Firewall Engine 1.2.276 and later are not
affected. To ensure that the latest automatic update is installed
on your computer, customers can view the Help>About screen in
their CA Personal Firewall product and confirm that the engine
version number is 1.2.276 or higher. For support information,
visit http://shop.ca.com/support.


How to determine if you are affected:
1. Using Windows Explorer, locate the file "kmxfw.sys". By default,
the file is located in the "C:\Windows\system32\drivers\" directory.
2. Right click on the file and select Properties.
3. Select the General tab.
4. If the file version is less than indicated in the below table,
the installation is vulnerable.

File Name Version Size (bytes) Date
kmxfw.sys 6.5.5.18 115,216 March 14, 2008


Workaround: None


References (URLs may wrap):
CA Support:
http://support.ca.com/
Security Notice for
CA Host-Based Intrusion Prevention System SDK
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=182496
Solution Document Reference APARs:
RO00535
CA Security Response Blog posting:
CA Host-Based Intrusion Prevention System SDK kmxfw.sys Multiple
Vulnerabilities
community.ca.com/blogs/casecurityresponseblog/archive/2008/08/12.aspx
Reported By:
Tobias Klein (CVE-2008-2926)
http://www.trapkit.de/
Elazar Broad (CVE-2008-3174)
CVE References:
CVE-2008-2926 - CA HIPS kmxfw.sys IOCTL
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2926
CVE-2008-3174 - CA HIPS kmxfw.sys denial of service
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3174
OSVDB References: Pending
http://osvdb.org/


Changelog for this advisory:
v1.0 - Initial Release


Customers who require additional information should contact CA
Technical Support at http://support.ca.com.

For technical questions or comments related to this advisory,
please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your
findings to our product security response team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782


Regards,
Ken Williams ; 0xE2941985
Director, CA Vulnerability Research


CA, 1 CA Plaza, Islandia, NY 11749

Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2008 CA. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.5.3 (Build 5003)

wj4DBQFIoduueSWR3+KUGYURAmmKAJ9FWl5gIZrbrGhg5CZ0NKzw0QE8qQCY+Qys
ekQdlRjiIYnyp9WEqqGAxQ==
=ltU4
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close