Title: CA Host-Based Intrusion Prevention System SDK kmxfw.sys
CA Advisory Date: 2008-08-11
CVE-2008-2926 - Tobias Klein
CVE-2008-3174 - Elazar Broad
Impact: A remote attacker can cause a denial of service or
possibly execute arbitrary code.
Summary: CA Host-Based Intrusion Prevention System SDK contains
two vulnerabilities that can allow an attacker to cause a denial
of service or possibly execute arbitrary code. CA has issued
updates to address the vulnerabilities. The first vulnerability,
CVE-2008-2926, occurs due to insufficient verification of IOCTL
requests by the kmxfw.sys driver. A local attacker can send an
IOCTL request that can cause a system crash or potentially result
in arbitrary code execution. The second vulnerability,
CVE-2008-3174, occurs due to insufficient validation by the
kmxfw.sys driver. An attacker can make a request that can cause a
Mitigating Factors: None
Severity: CA has given these vulnerabilities a Medium risk rating.
CA Host-Based Intrusion Prevention System r8
CA Internet Security Suite 2007 (v3.2) with CA Personal Firewall
2007 (v9.1) Engine version 1.2.260 and below
CA Internet Security Suite 2008 (v4.0) with CA Personal Firewall
2008 (v10.0) Engine version 1.2.260 and below
CA Personal Firewall 2007 (v9.1) with Engine version 1.2.260 and
CA Personal Firewall 2008 (v10.0) with Engine version 1.2.260 and
Status and Recommendation:
CA has issued the following updates to address the vulnerabilities.
CA Host-Based Intrusion Prevention System r8:
CA Internet Security Suite r3, r4 and CA Personal Firewall 2007,
Ensure the latest engine is installed by using the built-in update
mechanism. CA Personal Firewall Engine 1.2.276 and later are not
affected. To ensure that the latest automatic update is installed
on your computer, customers can view the Help>About screen in
their CA Personal Firewall product and confirm that the engine
version number is 1.2.276 or higher. For support information,
How to determine if you are affected:
1. Using Windows Explorer, locate the file "kmxfw.sys". By default,
the file is located in the "C:\Windows\system32\drivers\" directory.
2. Right click on the file and select Properties.
3. Select the General tab.
4. If the file version is less than indicated in the below table,
the installation is vulnerable.
File Name Version Size (bytes) Date
kmxfw.sys 126.96.36.199 115,216 March 14, 2008
References (URLs may wrap):
Security Notice for
CA Host-Based Intrusion Prevention System SDK
Solution Document Reference APARs:
CA Security Response Blog posting:
CA Host-Based Intrusion Prevention System SDK kmxfw.sys Multiple
Tobias Klein (CVE-2008-2926)
Elazar Broad (CVE-2008-3174)
CVE-2008-2926 - CA HIPS kmxfw.sys IOCTL
CVE-2008-3174 - CA HIPS kmxfw.sys denial of service
OSVDB References: Pending
Changelog for this advisory:
v1.0 - Initial Release
Customers who require additional information should contact CA
Technical Support at http://support.ca.com.
For technical questions or comments related to this advisory,
please send email to vuln AT ca DOT com.
If you discover a vulnerability in CA products, please report your
findings to our product security response team.
Ken Williams ; 0xE2941985
Director, CA Vulnerability Research
CA, 1 CA Plaza, Islandia, NY 11749
Legal Notice http://www.ca.com/us/legal/
Copyright (c) 2008 CA. All rights reserved.