CVE-2007-4216

Related Files

iDEFENSE Security Advisory 2007-08-20.2

Posted Aug 21, 2007

Authored by iDefense Labs, Ruben Santamarta | Site idefense.com

iDefense Security Advisory 08.20.07 - Local exploitation of multiple input validation vulnerabilities within multiple Check Point Zone Alarm products could allow an attacker to execute arbitrary code in kernel (ring0) context. The problems specifically exist within the IOCTL handling code in the vsdatant.sys device driver. The device driver fails to validate user-land supplied addresses passed to IOCTL 0x8400000F and IOCTL 0x84000013. Since the Irp parameters are not correctly validated, an attacker could utilize these IOCTLs to overwrite arbitrary memory with the constant double-word value of 0x60001 or the contents of a buffer returned from ZwQuerySystemInformation. This includes kernel memory as well as the code segments of running processes. iDefense has confirmed the existence of these vulnerabilities within version 6.5.737.0 of vsdatant.sys as installed with Check Point Zone Labs Zone Alarm Free. All other products within the Zone Alarm product line are suspected to be vulnerable. Previous versions are also suspected to be vulnerable.

tags | advisory, arbitrary, kernel, local, vulnerability

advisories | CVE-2007-4216

SHA-256 | ac81452faefe840d9f43dafabb215a820a2aa179a4f8fc68dcd428acf8f7a47d

Download | Favorite | View