mailing list archives
Comodo Bypassing settings protection using magic pipe Vulnerability
From: Matousec - Transparent security Research <research () matousec com>
Date: Thu, 01 Mar 2007 11:40:40 +0100
We would like to inform you about a vulnerability in Comodo Firewall Pro.
Comodo Firewall Pro (former Comodo Personal Firewall) stores some of its internal settings in the registry key
HKLM\SYSTEM\Software\Comodo\Personal Firewall. This key is protected by Comodo drivers such that other applications are
not able to change the settings. This protection can be bypassed if very special conditions are met. CFP internally
a named pipe, which name varies, but can be always determined. A process that opens this pipe many times is able to
manipulate the protected settings of CFP. A proper modification of the settings will disable all protection mechanisms
implemented by CFP after a reboot.
* Comodo Firewall Pro 188.8.131.52
* Comodo Firewall Pro 184.108.40.206
* Comodo Firewall Pro 220.127.116.11
* Comodo Personal Firewall 18.104.22.168
* probably all older versions of Comodo Personal Firewall 2
* possibly older versions of Comodo Personal Firewall
More details and a proof of concept including its source code are available here:
Matousec - Transparent security Research
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Comodo Bypassing settings protection using magic pipe Vulnerability Matousec - Transparent security Research (Mar 01)