matousec.com (site map)

Poll

On Windows Vista I use

  → unlimited administrator's account (26.1%)

  → limited administrator's account (9.01%)

  → common user's account (3.23%)

  → nothing (I do not use Vista) (61.66%)

more

results

Advisory 2007-05-15.01

Bypassing PFW/HIPS open process control with uncommon identifier

Basic information:


Release date: May 15, 2007

Last update: June 1, 2007

Severity:Critical bugs

Character:Complete system control

Status:Fixed

Testing program: BTP00000P000ZA.zip (for ZA)

  BTP00002P005CF.zip (for CFP)

Description:

Windows operating systems with NT kernel version 5.0 and higher (i.e. Windows 2000, XP, 2003) use integer numbers divisible by four to identify processes. Internal implementation of system API functions also allows programmers to use integers that are not divisible by four. This means that for every process running in the system there are four valid identifiers.

The control of API functions, which work with process identifiers, like OpenProcess (usually implemented by SSDT hook of NtOpenProcess), that assumes using identifiers divisible by four is insufficient. An implementation by a simple test on equivalence between the internal personal firewall/HIPS database and the given identifier can be dangerous. In such case, it is possible that a firewall misinterprets a call and allows an action that should be forbidden. If the security software implements a process protection for critical processes in this manner, it is a critical bug, which can be exploited to gain control over the whole system. Vulnerable products implements process protection, which can be bypassed if identifiers not divisible by four are used.

Vulnerable software:

Not vulnerable software:

Events:

References: