CVE-2006-3697

Agnitum Outpost Firewall Pro 3.51.759.6511 (462), as used in (1) Lavasoft Personal Firewall 1.0.543.5722 (433) and (2) Novell BorderManager Novell Client Firewall 2.0, does not properly restrict user activities in application windows that run in a LocalSystem context, which allows local users to gain privileges and execute commands (a) via the "open folder" option when no instance of explorer.exe is running, possibly related to the ShellExecute API function; or (b) by overwriting a batch file through the "Save Configuration As" option. NOTE: this might be a vulnerability in Microsoft Windows and explorer.exe instead of the firewall.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.ben.goulding.com.au/secad.html
http://www.securityfocus.com/bid/19018
http://www.securityfocus.com/bid/19024
http://secunia.com/advisories/21088	Vendor Advisory
http://secunia.com/advisories/21089	Vendor Advisory
https://secure-support.novell.com/KanisaPlatform/Publishing/903/3762108_f.SAL_Public.html
http://www.osvdb.org/27349
http://www.vupen.com/english/advisories/2006/2851	Vendor Advisory
http://www.vupen.com/english/advisories/2006/2852	Vendor Advisory
http://www.vupen.com/english/advisories/2007/0144	Vendor Advisory
http://www.securityfocus.com/archive/1/440426/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:lavasoft:lavasoft_personal_firewall:1.0.543.5722.433:::::::*
	cpe:2.3:a:novell:client_firewall:2.0:::::::*
	cpe:2.3:a:agnitum:outpost_firewall:3.51.759.6511:::::::*

Information

Published : 2006-07-21 07:03

Updated : 2018-10-18 09:48

NVD link : CVE-2006-3697

Mitre link : CVE-2006-3697

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

novell

client_firewall

agnitum

outpost_firewall

lavasoft

lavasoft_personal_firewall

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.ben.goulding.com.au/secad.html", "name": "http://www.ben.goulding.com.au/secad.html", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/19018", "name": "19018", "tags": [], "refsource": "BID"}, {"url": "http://www.securityfocus.com/bid/19024", "name": "19024", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/21088", "name": "21088", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/21089", "name": "21089", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://secure-support.novell.com/KanisaPlatform/Publishing/903/3762108_f.SAL_Public.html", "name": "https://secure-support.novell.com/KanisaPlatform/Publishing/903/3762108_f.SAL_Public.html", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.osvdb.org/27349", "name": "27349", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2006/2851", "name": "ADV-2006-2851", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "http://www.vupen.com/english/advisories/2006/2852", "name": "ADV-2006-2852", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "http://www.vupen.com/english/advisories/2007/0144", "name": "ADV-2007-0144", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/archive/1/440426/100/0/threaded", "name": "20060716 Escalation of privileges in Outpost and Lavasoft Firewalls -Unusual ShellExecute behavior", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Agnitum Outpost Firewall Pro 3.51.759.6511 (462), as used in (1) Lavasoft Personal Firewall 1.0.543.5722 (433) and (2) Novell BorderManager Novell Client Firewall 2.0, does not properly restrict user activities in application windows that run in a LocalSystem context, which allows local users to gain privileges and execute commands (a) via the \"open folder\" option when no instance of explorer.exe is running, possibly related to the ShellExecute API function; or (b) by overwriting a batch file through the \"Save Configuration As\" option. NOTE: this might be a vulnerability in Microsoft Windows and explorer.exe instead of the firewall."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-3697", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": true, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-07-21T14:03Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:lavasoft:lavasoft_personal_firewall:1.0.543.5722.433:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:novell:client_firewall:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:agnitum:outpost_firewall:3.51.759.6511:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-18T16:48Z"}