Poll
Is leak(test) protection important?
Advisory 2006-12-01.01
Outpost Bypassing Self-Protection via Advanced DLL injection with handle stealing Vulnerability
Basic information:
Release date: December 01, 2006
Last update: November 02, 2007
Severity:Critical
Character:Complete system control
Status:Fixed
Testing program: BTP00012P004AO.zip
Description:
The system process services.exe cares about system services. It runs them during the system boot and thus owns full access handles to all system services. Outpost protects all processes against common DLL injection and forbids other processes to manipulate its own service process. However, it does not protect services.exe against Advanced DLL injection that does not rely on writing into the target process memory. It is possible to infect services.exe with a malicious DLL and execute an arbitrary code in this system process. It is also possible to find and use its handle of the outpost.exe process to infect Outpost service process similarly. As a result, the attacker is able to inject an arbitrary code into the Outpost's process and thus bypass any of its security mechanisms.
Vulnerable software:
- Outpost Firewall PRO 4.0 (1024.700.292)
- Outpost Firewall PRO 4.0 (1007.591.145)
- Outpost Firewall PRO 4.0 (1005.590.123)
- Outpost Firewall PRO 4.0 (971.584.079)
- Outpost Firewall PRO 4.0 (964.582.059)
- probably all older versions of Outpost Firewall PRO 4.0
- possibly older versions of Outpost Firewall PRO
Not vulnerable software:
- Outpost Firewall Pro 2008 6.0.2162.205.402.266 and higher
Events:
- 2007-10-24: The product vendor released Outpost Firewall Pro 2008 6.0.2162.205.402.266, which fixed the bug
- 2006-12-05: Vulnerability confirmed by popular information sources
- 2006-12-01: Advisory released
- 2006-12-01: Vendor notification