David Matousek

**Name of the Vulnerable Software and Affected Versions** Sunbelt Kerio Personal Firewall versions 4.3.268 and earlier **Description** The issue concerns the fwdrv.sys and khips.sys drivers, which do not validate arguments passed to SSDT functions. This includes functions such as NtCreateFile, NtDeleteFile, NtLoadDriver, NtMapViewOfSection, NtOpenFile, and NtSetInformationFile. As a result, local users can cause a denial of service, potentially leading to a system crash, and possibly other impacts. **Recommendations** For Sunbelt Kerio Personal Firewall versions 4.3.268 and earlier, consider updating to a version that addresses this issue, as the current version allows for potential denial of service and other impacts due to the lack of argument validation in the fwdrv.sys and khips.sys drivers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Symantec Norton Personal Firewall versions 9.1.0.33 and other versions Symantec Internet Security (affected versions not specified) Symantec AntiVirus (affected versions not specified) Symantec SystemWorks (affected versions not specified) Symantec Client Security SCS versions 1.x through 3.1 Symantec AntiVirus Corporate Edition SAVCE versions 8.x through 10.1 Symantec pcAnywhere version 11.5 Symantec Host (affected versions not specified) **Description** The issue allows local users to cause a denial of service, resulting in a system crash, by sending invalid data. This can be achieved by calling `DeviceIoControl` to send the data. **Recommendations** For Symantec Norton Personal Firewall version 9.1.0.33, update to a version that fixes the issue. For Symantec Internet Security, update to a version that fixes the issue. For Symantec AntiVirus, update to a version that fixes the issue. For Symantec SystemWorks, update to a version that fixes the issue. For Symantec Client Security SCS versions 1.x through 3.1, update to a version later than 3.1. For Symantec AntiVirus Corporate Edition SAVCE versions 8.x through 10.1, update to a version later than 10.1. For Symantec pcAnywhere version 11.5, update to a version that fixes the issue. For Symantec Host, update to a version that fixes the issue.

**Name of the Vulnerable Software and Affected Versions** BlackICE PC Protection versions 3.6.cpn, 3.6.cpj, 3.6.cpiE, and possibly 3.6 and earlier BlackICE PC Protection version 3.6.cqn **Description** The issue allows local users to cause a denial of service, resulting in a crash, by providing a NULL third argument to the `NtOpenSection` API function. **Recommendations** For BlackICE PC Protection versions 3.6.cpn, 3.6.cpj, 3.6.cpiE, 3.6.cqn, and possibly 3.6 and earlier, consider avoiding the use of the `NtOpenSection` API function with a NULL third argument until a patch is available. As a temporary workaround, consider restricting access to the `RapDrv.sys` driver to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Symantec Norton Personal Firewall 2006 version 9.1.0.33 and possibly earlier **Description** The issue allows local users to provide Trojan horse libraries by modifying the HKLMSOFTWARESymantecCCPDSuiteOwners registry key using RegSaveKey and RegRestoreKey, as demonstrated with NISProd.dll. This attack typically requires administrative privileges and does not cross privilege boundaries. However, it is considered a vulnerability because the product is intended to protect against such privileged actions. **Recommendations** For Symantec Norton Personal Firewall 2006 version 9.1.0.33 and possibly earlier, consider restricting access to the HKLMSOFTWARESymantecCCPDSuiteOwners registry key to prevent unauthorized modifications. Additionally, as a temporary workaround, consider disabling the use of RegSaveKey and RegRestoreKey functions to modify this key until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ISS BlackICE PC Protection versions 3.6.cpj, 3.6.cpiE, and possibly earlier versions **Description** The issue concerns the improper monitoring of the integrity of the `pamversion.dll` BlackICE library, allowing local users to subvert BlackICE by replacing `pamversion.dll`. This is considered a vulnerability because BlackICE is intended to protect against certain rogue privileged actions. Note that replacing `pamversion.dll` requires administrative privileges, which means the attack would not typically cross privilege boundaries. **Recommendations** For ISS BlackICE PC Protection versions 3.6.cpj, 3.6.cpiE, and possibly earlier versions, consider implementing additional integrity checks on the `pamversion.dll` library to prevent unauthorized replacement. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sunbelt Kerio Personal Firewall versions 4.3.x before 4.3.268 **Description** The issue is related to the kpf4ss.exe component, which fails to properly hook the CreateRemoteThread API function. This allows local users to cause a denial of service, resulting in a crash, and bypass protection mechanisms by calling CreateRemoteThread. **Recommendations** For Sunbelt Kerio Personal Firewall versions 4.3.x before 4.3.268, update to version 4.3.268 or later to resolve the issue. As a temporary workaround, consider restricting access to the CreateRemoteThread API function until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Norton Personal Firewall 2006 version 9.1.0.33 **Description** The issue allows local users to cause a denial of service, resulting in a crash, by performing certain operations on specific registry keys. These operations include RegSaveKey, RegRestoreKey, and RegDeleteKey on the HKLMSYSTEMCurrentControlSetServicesSNDSrvc and HKLMSYSTEMCurrentControlSetServicesSymEvent registry keys. **Recommendations** For Norton Personal Firewall 2006 version 9.1.0.33, consider restricting access to the HKLMSYSTEMCurrentControlSetServicesSNDSrvc and HKLMSYSTEMCurrentControlSetServicesSymEvent registry keys to minimize the risk of exploitation. Avoid using the `RegSaveKey`, `RegRestoreKey`, and `RegDeleteKey` operations on these keys until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.