CVE-2006-7160
The Sandbox.sys driver in Outpost Firewall PRO 4.0, and possibly earlier versions, does not validate arguments to hooked SSDT functions, which allows local users to cause a denial of service (crash) via invalid arguments to the (1)…
Does this matter?
Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.
Description
The Sandbox.sys driver in Outpost Firewall PRO 4.0, and possibly earlier versions, does not validate arguments to hooked SSDT functions, which allows local users to cause a denial of service (crash) via invalid arguments to the (1) NtAssignProcessToJobObject,, (2) NtCreateKey, (3) NtCreateThread, (4) NtDeleteFile, (5) NtLoadDriver, (6) NtOpenProcess, (7) NtProtectVirtualMemory, (8) NtReplaceKey, (9) NtTerminateProcess, (10) NtTerminateThread, (11) NtUnloadDriver, and (12) NtWriteVirtualMemory functions.
- CVSS 2.0
- 4.9 MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
- EPSS
- 0.36% probability · 29th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- agnitum/outpost firewall
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/22913Vendor Advisory
- http://securityreason.com/securityalert/2376
- http://www.matousec.com/info/advisories/Outpost-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.phpVendor Advisory
- http://www.securityfocus.com/archive/1/451672/100/0/threaded
- http://www.securityfocus.com/bid/21097
- http://www.vupen.com/english/advisories/2006/4537Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30312
- http://secunia.com/advisories/22913Vendor Advisory
- http://securityreason.com/securityalert/2376
- http://www.matousec.com/info/advisories/Outpost-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.phpVendor Advisory
- http://www.securityfocus.com/archive/1/451672/100/0/threaded
- http://www.securityfocus.com/bid/21097
- http://www.vupen.com/english/advisories/2006/4537Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30312
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.