high7.2Public exploit code
CVE-2006-6619
AVG Anti-Virus plus Firewall 7.5.431 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's cont…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Multiple Vendor Firewall - HIPS Process Spoofing2006-12-15 · dos · windows · Verified
Impact
AVG Anti-Virus plus Firewall 7.5.431 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Avg | Antivirus Plus Firewall | Version 7.5.431 |
| Comodo | Comodo Personal Firewall | Version 2.3.6.81 |
| Filseclab | Personal Firewall | Version 3.0.8686 |
| Infoprocess | Antihook | Version 3.0.23 |
| Soft4ever | Look N Stop | Version 2.05p2 |
| Symantec | Sygate Personal Firewall | Version 5.6.2808 |
References
- NVD record
- CVE.org record
- http://www.matousec.com/downloads/windows-personal-firewall-analysis/ex-coat.zip
- http://www.matousec.com/info/advisories/Bypassing-process-identification-serveral-personal-firewalls-HIPS.php
- http://www.securityfocus.com/archive/1/454522/100/0/threaded
- http://www.securityfocus.com/bid/21615
- http://www.matousec.com/downloads/windows-personal-firewall-analysis/ex-coat.zip
- http://www.matousec.com/info/advisories/Bypassing-process-identification-serveral-personal-firewalls-HIPS.php
- http://www.securityfocus.com/archive/1/454522/100/0/threaded
- http://www.securityfocus.com/bid/21615