Description
Soft4Ever Look 'n' Stop (LnS) 2.05p2 before 20061215 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.matousec.com/info/advisories/Bypassing-process-identification-serveral-personal-firewalls-HIPS.php ↗
- http://www.securityfocus.com/archive/1/454522/100/0/threaded ↗
- http://www.securityfocus.com/bid/21615 ↗
- http://www.wilderssecurity.com/showthread.php?t=158155 ↗
- http://www.matousec.com/downloads/windows-personal-firewall-analysis/ex-coat.zip ↗