full-disclosure - Bypassing PFW/HIPS open process control with uncommon identifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4649637A.3010905@matousec.com>
Date: Tue, 15 May 2007 09:38:34 +0200
From: Matousec - Transparent security Research <research@...ousec.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Bypassing PFW/HIPS open process control with
	uncommon identifier

Hello,

We would like to inform you about a vulnerability in personal firewalls and HIPS software.

Description:

Windows operating systems with NT kernel version 5.0 and higher (i.e. Windows 2000, XP, 2003) use integer numbers 
divisible by four to identify processes. Internal implementation of system API functions also allows programmers to use 
integers that are not divisible by four. This means that for every process running in the system there are four valid 
identifiers.

The control of API functions, which work with process identifiers, like OpenProcess (usually implemented by SSDT hook of 
NtOpenProcess), that assumes using identifiers divisible by four is insufficient. An implementation by a simple test on 
equivalence between the internal personal firewall/HIPS database and the given identifier can be dangerous. In such 
case, it is possible that a firewall misinterprets a call and allows an action that should be forbidden. If the security 
software implements a process protection for critical processes in this manner, it is a critical bug, which can be 
exploited to gain control over the whole system. Vulnerable products implements process protection, which can be 
bypassed if identifiers not divisible by four are used.

Vulnerable software:

     * Comodo Firewall Pro 2.4.18.184
     * Comodo Personal Firewall 2.3.6.81
     * ZoneAlarm Pro 6.1.744.001
     * probably older versions of above mentioned products
     * possibly other personal firewalls and HIPS software

Not vulnerable software:

     * ZoneAlarm Pro 6.5.737.000 and higher

More details and a proof of concept including its source code are available here:
http://www.matousec.com/info/advisories/Bypassing-PWF-HIPS-open-process-control-with-uncommon-identifier.php

Regards,

-- 
Matousec - Transparent security Research
http://www.matousec.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/