Multiple Vendor Firewall - HIPS Process Spoofing

Author: Matousec Transparent security
type: dos
platform: windows
port: 
date_added: 2006-12-15 
date_updated: 2013-11-11 
verified: 1 
codes: CVE-2006-6619;OSVDB-33309 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/21615/info

Multiple vendor firewalls and HIPS (host-based intrusion prevention systems) are prone to a process-spoofing vulnerability.

An attacker can exploit this issue to have an arbitrary malicious program appear to run as a trusted process and function undetected on an affected victim's computer.

The following software is vulnerable; other versions may also be affected:

InfoProcess AntiHook version 3.0.0.23
AVG Anti-Virus plus Firewall version 7.5.431
Comodo Personal Firewall version 2.3.6.81
Filseclab Personal Firewall version 3.0.0.8686
Look 'n' Stop Personal Firewall version 2.05p2
Symantec Sygate Personal Firewall version 5.6.2808

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29287.zip