Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Kerio Personal Firewall and Kerio Server Firewall FWDRV driver Local Denial of Service
From: Piotr Bania <bania.piotr () gmail com>
Date: Thu, 13 Oct 2005 15:17:36 +0200

        Kerio Technologies Kerio Personal Firewall and Kerio Server
        Firewall FWDRV driver
        Local denial of service
        by Piotr Bania <bania.piotr () gmail com>

        Original location:      
        Severity:               Low (local machine denial of service -

        Software affected:      Tested on Kerio Personal Firewall 4
                                (4.2.0) and  KerioServerFirewall
version 1.1.1, however it is highly
                                possible that earlier versions
                                are also vulnerable.

        I.  BACKGROUND

        From kerio.com website:

        "Kerio Personal Firewall represents smart, easy-to-use personal
         security technology that fully protects personal computers
         against hackers and internal misuse"

        "Kerio ServerFirewall offers IT and security administrators a
         powerful and easy-to-use tool to protect their server systems
         from worms, buffer-overflow and other internet security


        FWDRV driver (core part of the firewall system) monitors all
        programs that are trying to connect to the internet. While doing
        necessary checks, FWDRV parses the Process Environment Block
        (PEB) like the code shows:

        .text:0041C04E  mov     ecx, [ebp+var_4]  ; ECX = PEB base
        .text:0041C051  mov     edx, [ecx+0Ch]    ; EDX = PEB_LDR_DATA

        However while parsing the PEB FWDRV doesn't check if the memory
        with Process Environment Block is accessible. It means that if
        attacker will set PAGE_NOACCESS or PAGE_GUARD protection to the
        PEB block the FWDRV will cause an fatal exception and the
        machine will crash.

        III. IMPACT

        Sample scenario:
        Executing connect api function with previously PAGE_NOACCESS
        protection set to Process Environment Block will cause an local
        machine crash.

        IV. POC CODE

        Sample POC code was released to vendor.

best regards,
Piotr Bania

Piotr Bania - <bania.piotr () gmail com> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A  BFA4 1FF6 689F BE43 AC33
http://pb.specialised.info  - Key ID: 0xBE43AC33

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]