CVEvulnerability

CVE-2007-4967

4.4 MEDIUM Published 2007-09-19 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2007-09-19
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20, CWE-264

Description

Online Armor Personal Firewall 2.0.1.215 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via unspecified kernel SSDT hooks for Windows Native API functions including (1) NtAllocateVirtualMemory, (2) NtConnectPort, (3) NtCreateFile, (4) NtCreateKey, (5) NtCreatePort, (6) NtDeleteFile, (7) NtDeleteValueKey, (8) NtLoadKey, (9) NtOpenFile, (10) NtOpenProcess, (11) NtOpenThread, (12) NtResumeThread, (13) NtSetContextThread, (14) NtSetValueKey, (15) NtSuspendProcess, (16) NtSuspendThread, and (17) NtTerminateThread.

Affected configurations

• online armor personal firewall 2.0.1.215

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References