full-disclosure - Comodo Bypassing settings protection using magic pipe Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <45E6ADA8.50407@matousec.com>
Date: Thu, 01 Mar 2007 11:40:40 +0100
From: Matousec - Transparent security Research <research@...ousec.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Comodo Bypassing settings protection using magic
	pipe Vulnerability

Hello,

We would like to inform you about a vulnerability in Comodo Firewall Pro.

Description:

Comodo Firewall Pro (former Comodo Personal Firewall) stores some of its internal settings in the registry key 
HKLM\SYSTEM\Software\Comodo\Personal Firewall. This key is protected by Comodo drivers such that other applications are 
not able to change the settings. This protection can be bypassed if very special conditions are met. CFP internally uses 
a named pipe, which name varies, but can be always determined. A process that opens this pipe many times is able to 
manipulate the protected settings of CFP. A proper modification of the settings will disable all protection mechanisms 
implemented by CFP after a reboot.

Vulnerable software:

     * Comodo Firewall Pro 2.4.18.184
     * Comodo Firewall Pro 2.4.17.183
     * Comodo Firewall Pro 2.4.16.174
     * Comodo Personal Firewall 2.3.6.81
     * probably all older versions of Comodo Personal Firewall 2
     * possibly older versions of Comodo Personal Firewall

More details and a proof of concept including its source code are available here:
http://www.matousec.com/info/advisories/Comodo-Bypassing-settings-protection-using-magic-pipe.php

Regards,

-- 
Matousec - Transparent security Research
http://www.matousec.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/