CVE-2006-6619

Multiple Vendor Firewall - HIPS Process Spoofing

Severity Score

7.2

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

AVG Anti-Virus plus Firewall 7.5.431 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.

AVG Anti-Virus plus Firewall 7.5.431 depende del Process Environment Block (PEB) para la identificación de un proceso, el cual permite a usuarios locales evitar los controles del producto en el proceso mediante la simulación de los campos (1) ImagePathName, (2) CommandLine y(3) WindowTitle en el PEB

*Credits: N/A

CVSS Scores

NISTv2 7.2

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2006-12-15 First Exploit
2006-12-17 CVE Reserved
2006-12-18 CVE Published
2023-03-08 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (5)

URL	Tag	Source
http://www.matousec.com/downloads/windows-personal-firewall-analysis/ex-coat.zip	X_refsource_misc
http://www.securityfocus.com/archive/1/454522/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/21615	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/29287	2006-12-15

URL	Date	SRC

URL	Date	SRC
http://www.matousec.com/info/advisories/Bypassing-process-identification-serveral-personal-firewalls-HIPS.php	2018-10-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Avg Search vendor "Avg"		Antivirus Plus Firewall Search vendor "Avg" for product "Antivirus Plus Firewall"				7.5.431 Search vendor "Avg" for product "Antivirus Plus Firewall" and version "7.5.431"		-		Affected
Comodo Search vendor "Comodo"		Comodo Personal Firewall Search vendor "Comodo" for product "Comodo Personal Firewall"				2.3.6.81 Search vendor "Comodo" for product "Comodo Personal Firewall" and version "2.3.6.81"		-		Affected
Filseclab Search vendor "Filseclab"		Personal Firewall Search vendor "Filseclab" for product "Personal Firewall"				3.0.8686 Search vendor "Filseclab" for product "Personal Firewall" and version "3.0.8686"		-		Affected
Infoprocess Search vendor "Infoprocess"		Antihook Search vendor "Infoprocess" for product "Antihook"				3.0.23 Search vendor "Infoprocess" for product "Antihook" and version "3.0.23"		-		Affected
Soft4ever Search vendor "Soft4ever"		Look N Stop Search vendor "Soft4ever" for product "Look N Stop"				2.05p2 Search vendor "Soft4ever" for product "Look N Stop" and version "2.05p2"		-		Affected
Symantec Search vendor "Symantec"		Sygate Personal Firewall Search vendor "Symantec" for product "Sygate Personal Firewall"				5.6.2808 Search vendor "Symantec" for product "Sygate Personal Firewall" and version "5.6.2808"		-		Affected