CVE-2006-3697
Agnitum Outpost Firewall Pro 3.51.759.6511 (462), as used in (1) Lavasoft Personal Firewall 1.0.543.5722 (433) and (2) Novell BorderManager Novell Client Firewall 2.0, does not properly restrict user activities in application windows that run in a…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Agnitum Outpost Firewall Pro 3.51.759.6511 (462), as used in (1) Lavasoft Personal Firewall 1.0.543.5722 (433) and (2) Novell BorderManager Novell Client Firewall 2.0, does not properly restrict user activities in application windows that run in a LocalSystem context, which allows local users to gain privileges and execute commands (a) via the "open folder" option when no instance of explorer.exe is running, possibly related to the ShellExecute API function; or (b) by overwriting a batch file through the "Save Configuration As" option. NOTE: this might be a vulnerability in Microsoft Windows and explorer.exe instead of the firewall.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 0.48% probability · 40th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- agnitum/outpost firewall · lavasoft/lavasoft personal firewall · novell/client firewall
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/21088Vendor Advisory
- http://secunia.com/advisories/21089Vendor Advisory
- http://www.ben.goulding.com.au/secad.html
- http://www.osvdb.org/27349
- http://www.securityfocus.com/archive/1/440426/100/0/threaded
- http://www.securityfocus.com/bid/19018
- http://www.securityfocus.com/bid/19024
- http://www.vupen.com/english/advisories/2006/2851Vendor Advisory
- http://www.vupen.com/english/advisories/2006/2852Vendor Advisory
- http://www.vupen.com/english/advisories/2007/0144Vendor Advisory
- https://secure-support.novell.com/KanisaPlatform/Publishing/903/3762108_f.SAL_Public.html
- http://secunia.com/advisories/21088Vendor Advisory
- http://secunia.com/advisories/21089Vendor Advisory
- http://www.ben.goulding.com.au/secad.html
- http://www.osvdb.org/27349
- http://www.securityfocus.com/archive/1/440426/100/0/threaded
- http://www.securityfocus.com/bid/19018
- http://www.securityfocus.com/bid/19024
- http://www.vupen.com/english/advisories/2006/2851Vendor Advisory
- http://www.vupen.com/english/advisories/2006/2852Vendor Advisory
- http://www.vupen.com/english/advisories/2007/0144Vendor Advisory
- https://secure-support.novell.com/KanisaPlatform/Publishing/903/3762108_f.SAL_Public.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.