The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Outpost Bypassing Self-Protection using File Links Vulnerability
------------------------------------------------------------------------
SUMMARY
A vulnerability in Outpost allows attackers to bypass the self-protecting
mechanism of the program allowing attackers to cause it to execute
arbitrary code.
DETAILS
Vulnerable software:
* Outpost Firewall PRO 4.0 (1005.590.123)
* Outpost Firewall PRO 4.0 (971.584.079)
* Outpost Firewall PRO 4.0 (964.582.059)
* probably all older versions of Outpost Firewall PRO 4.0
* possibly older versions of Outpost Firewall PRO
Outpost protects its files and forbids other applications to manipulate
them. Files and directories in its installation directory are guarded by
various SSDT hooks. However, the implementation of this protection does
not prevent malicious applications to call native API ZwSetInformationFile
class FileLinkInformation. Such calls can be used to replace files that
are not used by the system when this function is called. One of vulnerable
files in the Outpost installation directory is SandBox.sys, the driver
that implements Outpost Self-Protection mechanisms. Attackers are able to
replace this driver with a fake copy that will be loaded into the system
after the next reboot. This can result in a complete system control
because driver's code is executed in the privileged kernel mode. The fake
driver can be implemented such that the user has no chance to notice the
attack.
ADDITIONAL INFORMATION
The information has been provided by <mailto:research@matousec.com>
Matousec - Transparent security Research.
The original article can be found at:
<http://www.matousec.com/info/advisories/Outpost-Bypassing-Self-Protection-using-file-links.php>
http://www.matousec.com/info/advisories/Outpost-Bypassing-Self-Protection-using-file-links.php
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
