Unscored severity · published Apr 30, 2008
CVE-2008-1736
Comodo Firewall Pro before 3.0 does not properly validate certain parameters to hooked System Service Descriptor Table (SSDT) functions, which allows local users to cause a denial…
–
CVSS
0.4%
EPSS
No
On KEV
Description
Comodo Firewall Pro before 3.0 does not properly validate certain parameters to hooked System Service Descriptor Table (SSDT) functions, which allows local users to cause a denial of service (system crash) via (1) a crafted OBJECT_ATTRIBUTES structure in a call to the NtDeleteFile function, which leads to improper validation of a ZwQueryObject result; and unspecified calls to the (2) NtCreateFile and (3) NtSetThreadContext functions, different vectors than CVE-2007-0709.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Comodo Personal Firewall · Comodo
through 2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1736
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1736
Vendor Advisory
http://secunia.com/advisories/30006
securityreason.com
http://securityreason.com/securityalert/3838
securitytracker.com
http://securitytracker.com/id?1019944
www.coresecurity.com
http://www.coresecurity.com/?action=item&id=2249
www.personalfirewall.comodo.com
http://www.personalfirewall.comodo.com/release_notes.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/491405/100/0/threaded
More from Comodo Personal Firewall
–
CVE-2007-2729
Comodo Firewall Pro 2.4.18.184 and Comodo Personal Firewall 2.3.6.81, and probably older Comodo Firewall versions, do not properly test for equivalence of process identifiers for…
–
CVE-2007-2730
Check Point ZoneAlarm Pro before 6.5.737.000 does not properly test for equivalence of process identifiers for certain Microsoft Windows API functions in the NT kernel 5.0 and…
–
CVE-2006-6621
Filseclab Personal Firewall 3.0.0.8686 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process…
–
CVE-2006-6618
AntiHook 3.0.0.23 - Desktop relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing…
–
CVE-2006-6623
Sygate Personal Firewall 5.6.2808 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by…