VAR-200510-0113

Vulnerability from variot - Updated: 2023-12-18 12:53

The FWDRV driver in Kerio Personal Firewall 4.2 and Server Firewall 1.1.1 allows local users to cause a denial of service (crash) by setting the PAGE_NOACCESS or PAGE_GUARD protection on the Page Environment Block (PEB), which triggers an exception, aka the "PEB lockout vulnerability.". Kerio Personal Firewall and ServerFirewall are prone to a local denial of service vulnerability. Reports indicate that the FWDRV driver does not verify access to memory associated with the Process Environment Block (PEB) of the application. An attacker can trigger fatal exceptions and cause the firewall process to terminate. A denial of service condition in the firewall can expose computers to further attacks. Kerio Personal Firewall and Server Firewall are easy-to-use firewall products. Kerio Personal Firewall and Server Firewall are easy-to-use firewall products. When parsing the PEB, FWDRV does not check whether the memory is accessible, that is to say, if the attacker can set PAGE_NOACCESS or PAGE_GUARD protection on the PEB, it will cause an exception and the machine will blue screen of death. This can be exploited to crash the system via a malicious application that locks the memory page where its PEB resides before connecting to the network. * Kerio ServerFirewall version 1.1.1 and prior.

SOLUTION: Kerio Personal Firewall: Update to version 4.2.1 or later.

Kerio ServerFirewall: Update to version 1.1.2 or later.

PROVIDED AND/OR DISCOVERED BY: Piotr Bania

ORIGINAL ADVISORY: Kerio: http://www.kerio.com/security_advisory.html

Piotr Bania: http://pb.specialised.info/all/adv/kerio-fwdrv-dos-adv.txt

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200510-0113",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "serverfirewall",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "kerio",
        "version": "1.1.1"
      },
      {
        "model": "personal firewall",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "kerio",
        "version": "4.2"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "15094"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3286"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200510-180"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:kerio:personal_firewall:4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:kerio:serverfirewall:1.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-3286"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Piotr Bania  bania.piotr@gmail.com",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200510-180"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2005-3286",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.1,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "LOW",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.1,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "VHN-14495",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "LOW",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2005-3286",
            "trust": 1.0,
            "value": "LOW"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200510-180",
            "trust": 0.6,
            "value": "LOW"
          },
          {
            "author": "VULHUB",
            "id": "VHN-14495",
            "trust": 0.1,
            "value": "LOW"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-14495"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3286"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200510-180"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The FWDRV driver in Kerio Personal Firewall 4.2 and Server Firewall 1.1.1 allows local users to cause a denial of service (crash) by setting the PAGE_NOACCESS or PAGE_GUARD protection on the Page Environment Block (PEB), which triggers an exception, aka the \"PEB lockout vulnerability.\". Kerio Personal Firewall and ServerFirewall are prone to a local denial of service vulnerability. \nReports indicate that the FWDRV driver does not verify access to memory associated with the Process Environment Block (PEB) of the application.  An attacker can trigger fatal exceptions and cause the firewall process to terminate. \nA denial of service condition in the firewall can expose computers to further attacks. Kerio Personal Firewall and Server Firewall are easy-to-use firewall products. Kerio Personal Firewall and Server Firewall are easy-to-use firewall products. When parsing the PEB, FWDRV does not check whether the memory is accessible, that is to say, if the attacker can set PAGE_NOACCESS or PAGE_GUARD protection on the PEB, it will cause an exception and the machine will blue screen of death. This can be exploited to crash the system via a malicious\napplication that locks the memory page where its PEB resides before\nconnecting to the network. \n* Kerio ServerFirewall version 1.1.1 and prior. \n\nSOLUTION:\nKerio Personal Firewall:\nUpdate to version 4.2.1 or later. \n\nKerio ServerFirewall:\nUpdate to version 1.1.2 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\nPiotr Bania\n\nORIGINAL ADVISORY:\nKerio:\nhttp://www.kerio.com/security_advisory.html\n\nPiotr Bania:\nhttp://pb.specialised.info/all/adv/kerio-fwdrv-dos-adv.txt\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-3286"
      },
      {
        "db": "BID",
        "id": "15094"
      },
      {
        "db": "VULHUB",
        "id": "VHN-14495"
      },
      {
        "db": "PACKETSTORM",
        "id": "40706"
      }
    ],
    "trust": 1.35
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "15094",
        "trust": 2.0
      },
      {
        "db": "SECUNIA",
        "id": "17155",
        "trust": 1.8
      },
      {
        "db": "OSVDB",
        "id": "19961",
        "trust": 1.7
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3286",
        "trust": 1.7
      },
      {
        "db": "SREASON",
        "id": "78",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200510-180",
        "trust": 0.7
      },
      {
        "db": "FULLDISC",
        "id": "20051013 KERIO PERSONAL FIREWALL AND KERIO SERVER FIREWALL FWDRV DRIVER LOCAL DENIAL OF SERVICE",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-14495",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "40706",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-14495"
      },
      {
        "db": "BID",
        "id": "15094"
      },
      {
        "db": "PACKETSTORM",
        "id": "40706"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3286"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200510-180"
      }
    ]
  },
  "id": "VAR-200510-0113",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-14495"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:53:36.792000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-3286"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "http://www.kerio.com/security_advisory.html"
      },
      {
        "trust": 1.8,
        "url": "http://pb.specialised.info/all/adv/kerio-fwdrv-dos-adv.txt"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/15094"
      },
      {
        "trust": 1.7,
        "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2005-october/037958.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.osvdb.org/19961"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/17155"
      },
      {
        "trust": 1.7,
        "url": "http://securityreason.com/securityalert/78"
      },
      {
        "trust": 1.1,
        "url": "http://seclists.org/bugtraq/2005/oct/166"
      },
      {
        "trust": 0.3,
        "url": "http://www.kerio.com"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/413253"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/1493/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/17155/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/2653/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/4378/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/2654/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-14495"
      },
      {
        "db": "BID",
        "id": "15094"
      },
      {
        "db": "PACKETSTORM",
        "id": "40706"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3286"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200510-180"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-14495"
      },
      {
        "db": "BID",
        "id": "15094"
      },
      {
        "db": "PACKETSTORM",
        "id": "40706"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3286"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200510-180"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2005-10-23T00:00:00",
        "db": "VULHUB",
        "id": "VHN-14495"
      },
      {
        "date": "2005-10-13T00:00:00",
        "db": "BID",
        "id": "15094"
      },
      {
        "date": "2005-10-14T22:19:03",
        "db": "PACKETSTORM",
        "id": "40706"
      },
      {
        "date": "2005-10-23T10:02:00",
        "db": "NVD",
        "id": "CVE-2005-3286"
      },
      {
        "date": "2005-10-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200510-180"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-12-13T00:00:00",
        "db": "VULHUB",
        "id": "VHN-14495"
      },
      {
        "date": "2005-10-13T00:00:00",
        "db": "BID",
        "id": "15094"
      },
      {
        "date": "2012-12-13T02:43:26.673000",
        "db": "NVD",
        "id": "CVE-2005-3286"
      },
      {
        "date": "2012-12-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200510-180"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "BID",
        "id": "15094"
      },
      {
        "db": "PACKETSTORM",
        "id": "40706"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200510-180"
      }
    ],
    "trust": 1.0
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Kerio Personal firewall and server firewall  PEB lockout Denial of service vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200510-180"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200510-180"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.