Multiple Vendor Firewalls and HIPS Process-Spoofing Vulnerability

vendor:

InfoProcess AntiHook, AVG Anti-Virus plus Firewall, Comodo Personal Firewall, Filseclab Personal Firewall, Look 'n' Stop Personal Firewall, Symantec Sygate Personal Firewall

by:

SecurityFocus

7.5

CVSS

HIGH

Process-Spoofing

264

CWE

Product Name: InfoProcess AntiHook, AVG Anti-Virus plus Firewall, Comodo Personal Firewall, Filseclab Personal Firewall, Look 'n' Stop Personal Firewall, Symantec Sygate Personal Firewall

Affected Version From: 3.0.0.23

Affected Version To: 5.6.2808

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2007

Multiple Vendor Firewalls and HIPS Process-Spoofing Vulnerability

An attacker can exploit this issue to have an arbitrary malicious program appear to run as a trusted process and function undetected on an affected victim's computer.

Mitigation:

Ensure that all firewalls and HIPS are up to date and patched with the latest security updates.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/21615/info

Multiple vendor firewalls and HIPS (host-based intrusion prevention systems) are prone to a process-spoofing vulnerability.

An attacker can exploit this issue to have an arbitrary malicious program appear to run as a trusted process and function undetected on an affected victim's computer.

The following software is vulnerable; other versions may also be affected:

InfoProcess AntiHook version 3.0.0.23
AVG Anti-Virus plus Firewall version 7.5.431 
Comodo Personal Firewall version 2.3.6.81
Filseclab Personal Firewall version 3.0.0.8686
Look 'n' Stop Personal Firewall version 2.05p2
Symantec Sygate Personal Firewall version 5.6.2808

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29287.zip