BugTraq
CA Host-Based Intrusion Prevention System SDK kmxfw.sys Multiple Vulnerabilities Aug 12 2008 06:53PM
Williams, James K (James Williams ca com)


Title: CA Host-Based Intrusion Prevention System SDK kmxfw.sys

Multiple Vulnerabilities

CA Advisory Date: 2008-08-11

Reported By:

CVE-2008-2926 - Tobias Klein

CVE-2008-3174 - Elazar Broad

Impact: A remote attacker can cause a denial of service or

possibly execute arbitrary code.

Summary: CA Host-Based Intrusion Prevention System SDK contains

two vulnerabilities that can allow an attacker to cause a denial

of service or possibly execute arbitrary code. CA has issued

updates to address the vulnerabilities. The first vulnerability,

CVE-2008-2926, occurs due to insufficient verification of IOCTL

requests by the kmxfw.sys driver. A local attacker can send an

IOCTL request that can cause a system crash or potentially result

in arbitrary code execution. The second vulnerability,

CVE-2008-3174, occurs due to insufficient validation by the

kmxfw.sys driver. An attacker can make a request that can cause a

system crash.

Mitigating Factors: None

Severity: CA has given these vulnerabilities a Medium risk rating.

Affected Products:

CA Host-Based Intrusion Prevention System r8

CA Internet Security Suite 2007 (v3.2) with CA Personal Firewall

2007 (v9.1) Engine version 1.2.260 and below

CA Internet Security Suite 2008 (v4.0) with CA Personal Firewall

2008 (v10.0) Engine version 1.2.260 and below

CA Personal Firewall 2007 (v9.1) with Engine version 1.2.260 and

below

CA Personal Firewall 2008 (v10.0) with Engine version 1.2.260 and

below

Affected Platforms:

Windows

Status and Recommendation:

CA has issued the following updates to address the vulnerabilities.

CA Host-Based Intrusion Prevention System r8:

RO00535

https://support.ca.com/irj/portal/anonymous/redirArticles?reqPage=search
&searchID=RO00535

CA Internet Security Suite r3, r4 and CA Personal Firewall 2007,

2008:

Ensure the latest engine is installed by using the built-in update

mechanism. CA Personal Firewall Engine 1.2.276 and later are not

affected. To ensure that the latest automatic update is installed

on your computer, customers can view the Help>About screen in

their CA Personal Firewall product and confirm that the engine

version number is 1.2.276 or higher. For support information,

visit http://shop.ca.com/support.

How to determine if you are affected:

1. Using Windows Explorer, locate the file "kmxfw.sys". By default,

the file is located in the "C:\Windows\system32\drivers\" directory.

2. Right click on the file and select Properties.

3. Select the General tab.

4. If the file version is less than indicated in the below table,

the installation is vulnerable.

File Name Version Size (bytes) Date

kmxfw.sys 6.5.5.18 115,216 March 14, 2008

Workaround: None

References (URLs may wrap):

CA Support:

http://support.ca.com/

Security Notice for

CA Host-Based Intrusion Prevention System SDK

https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1824
96

Solution Document Reference APARs:

RO00535

CA Security Response Blog posting:

CA Host-Based Intrusion Prevention System SDK kmxfw.sys Multiple

Vulnerabilities

community.ca.com/blogs/casecurityresponseblog/archive/2008/08/12.aspx

Reported By:

Tobias Klein (CVE-2008-2926)

http://www.trapkit.de/

Elazar Broad (CVE-2008-3174)

CVE References:

CVE-2008-2926 - CA HIPS kmxfw.sys IOCTL

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2926

CVE-2008-3174 - CA HIPS kmxfw.sys denial of service

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3174

OSVDB References: Pending

http://osvdb.org/

Changelog for this advisory:

v1.0 - Initial Release

Customers who require additional information should contact CA

Technical Support at http://support.ca.com.

For technical questions or comments related to this advisory,

please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your

findings to our product security response team.

https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1777
82

Regards,

Ken Williams ; 0xE2941985

Director, CA Vulnerability Research

CA, 1 CA Plaza, Islandia, NY 11749

Contact http://www.ca.com/us/contact/

Legal Notice http://www.ca.com/us/legal/

Privacy Policy http://www.ca.com/us/privacy/

Copyright (c) 2008 CA. All rights reserved.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus