Sign-up

ID

VAR-200808-0291


CVE

CVE-2008-3174


TITLE

CA Internet Security Suite Used for etc. CA HIPS of kmxfw.sys Service disruption in drivers (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2008-003251

DESCRIPTION

Unspecified vulnerability in the kmxfw.sys driver in CA Host-Based Intrusion Prevention System (HIPS) r8, as used in CA Internet Security Suite and Personal Firewall, allows remote attackers to cause a denial of service via unknown vectors, related to "insufficient validation.". (DoS) There is a vulnerability that becomes a condition.Service disruption by a third party (DoS) There is a possibility of being put into a state. Computer Associates products are prone to two vulnerabilities. Attackers may exploit the first vulnerability locally to execute arbitrary code with SYSTEM-level privileges or cause a system crash. Attackers may exploit the second vulnerability remotely to cause denial-of-service conditions. Successful attacks will completely compromise the computer or cause denial-of-service conditions. There is an unknown vulnerability in the kmxfw.sys driver in CA HIPS r8. 2) An unspecified error in the kmxfw.sys driver can be exploited to cause a DoS. PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Tobias Klein 2) Elazar Broad ORIGINAL ADVISORY: CA: http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=36559 http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=36560 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . CA has issued updates to address the vulnerabilities. The first vulnerability, CVE-2008-2926, occurs due to insufficient verification of IOCTL requests by the kmxfw.sys driver. The second vulnerability, CVE-2008-3174, occurs due to insufficient validation by the kmxfw.sys driver. An attacker can make a request that can cause a system crash. Mitigating Factors: None Severity: CA has given these vulnerabilities a Medium risk rating. CA Personal Firewall Engine 1.2.276 and later are not affected. To ensure that the latest automatic update is installed on your computer, customers can view the Help>About screen in their CA Personal Firewall product and confirm that the engine version number is 1.2.276 or higher. For support information, visit http://shop.ca.com/support. How to determine if you are affected: 1. Using Windows Explorer, locate the file "kmxfw.sys". By default, the file is located in the "C:\Windows\system32\drivers\" directory. 2. Right click on the file and select Properties. 3. Select the General tab. 4. If the file version is less than indicated in the below table, the installation is vulnerable. File Name Version Size (bytes) Date kmxfw.sys 6.5.5.18 115,216 March 14, 2008 Workaround: None References (URLs may wrap): CA Support: http://support.ca.com/ Security Notice for CA Host-Based Intrusion Prevention System SDK https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=182496 Solution Document Reference APARs: RO00535 CA Security Response Blog posting: CA Host-Based Intrusion Prevention System SDK kmxfw.sys Multiple Vulnerabilities community.ca.com/blogs/casecurityresponseblog/archive/2008/08/12.aspx Reported By: Tobias Klein (CVE-2008-2926) http://www.trapkit.de/ Elazar Broad (CVE-2008-3174) CVE References: CVE-2008-2926 - CA HIPS kmxfw.sys IOCTL http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2926 CVE-2008-3174 - CA HIPS kmxfw.sys denial of service http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3174 OSVDB References: Pending http://osvdb.org/ Changelog for this advisory: v1.0 - Initial Release Customers who require additional information should contact CA Technical Support at http://support.ca.com. For technical questions or comments related to this advisory, please send email to vuln AT ca DOT com. If you discover a vulnerability in CA products, please report your findings to our product security response team. https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782 Regards, Ken Williams ; 0xE2941985 Director, CA Vulnerability Research CA, 1 CA Plaza, Islandia, NY 11749 Contact http://www.ca.com/us/contact/ Legal Notice http://www.ca.com/us/legal/ Privacy Policy http://www.ca.com/us/privacy/ Copyright (c) 2008 CA. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj4DBQFIoduueSWR3+KUGYURAmmKAJ9FWl5gIZrbrGhg5CZ0NKzw0QE8qQCY+Qys ekQdlRjiIYnyp9WEqqGAxQ== =ltU4 -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2008-3174 // JVNDB: JVNDB-2008-003251 // BID: 30651 // VULHUB: VHN-33299 // PACKETSTORM: 68975 // PACKETSTORM: 69034

AFFECTED PRODUCTS

vendor:computer associatesmodel:host based intrusion prevention systemscope:eqversion:r8

Trust: 1.6

vendor:computer associatesmodel:internet security suitescope:eqversion:2007

Trust: 1.6

vendor:computer associatesmodel:personal firewallscope:eqversion:2007

Trust: 1.6

vendor:computer associatesmodel:personal firewallscope:eqversion:2008

Trust: 1.6

vendor:computer associatesmodel:internet security suitescope:eqversion:2008

Trust: 1.6

vendor:camodel:host-based intrusion prevention systemscope:eqversion:r8

Trust: 0.8

vendor:camodel:internet security suitescope: - version: -

Trust: 0.8

vendor:camodel:personal firewallscope: - version: -

Trust: 0.8

vendor:computermodel:associates personal firewallscope:eqversion:2008

Trust: 0.3

vendor:computermodel:associates personal firewallscope:eqversion:2007

Trust: 0.3

vendor:computermodel:associates internet security suitescope:eqversion:20080

Trust: 0.3

vendor:computermodel:associates internet security suitescope:eqversion:20070

Trust: 0.3

vendor:computermodel:associates host-based intrusion prevention system r8scope: - version: -

Trust: 0.3

vendor:computermodel:associates personal firewall enginescope:neversion:1.2.276

Trust: 0.3

sources: BID: 30651 // JVNDB: JVNDB-2008-003251 // CNNVD: CNNVD-200808-174 // NVD: CVE-2008-3174

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2008-3174
value: MEDIUM

Trust: 1.0

NVD: CVE-2008-3174
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200808-174
value: MEDIUM

Trust: 0.6

VULHUB: VHN-33299
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2008-3174
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-33299
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-33299 // JVNDB: JVNDB-2008-003251 // CNNVD: CNNVD-200808-174 // NVD: CVE-2008-3174

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2008-3174

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200808-174

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-200808-174

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2008-003251

PATCH
title:Top Pageurl:http://www.ca.com/us/default.aspx
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2008-003251

EXTERNAL IDS
db:NVDid:CVE-2008-3174
Trust: 2.9
db:BIDid:30651
Trust: 2.0
db:SECUNIAid:31434
Trust: 1.8
db:SECTRACKid:1020662
Trust: 1.7
db:SECTRACKid:1020661
Trust: 1.7
db:SECTRACKid:1020663
Trust: 1.7
db:VUPENid:ADV-2008-2339
Trust: 1.7
db:JVNDBid:JVNDB-2008-003251
Trust: 0.8
db:XFid:44393
Trust: 0.6
db:BUGTRAQid:20080812 CA HOST-BASED INTRUSION PREVENTION SYSTEM SDK KMXFW.SYS MULTIPLE VULNERABILITIES
Trust: 0.6
db:CNNVDid:CNNVD-200808-174
Trust: 0.6
db:VULHUBid:VHN-33299
Trust: 0.1
db:PACKETSTORMid:68975
Trust: 0.1
db:PACKETSTORMid:69034
Trust: 0.1
sources:
            
            
            VULHUB: VHN-33299 // 
            
            
            
            BID: 30651 // 
            
            
            
            JVNDB: JVNDB-2008-003251 // 
            
            
            
            PACKETSTORM: 68975 // 
            
            
            
            PACKETSTORM: 69034 // 
            
            
            
            CNNVD: CNNVD-200808-174 // 
            
            
            
            NVD: CVE-2008-3174

REFERENCES
url:http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=36560
Trust: 2.1
url:http://www.securityfocus.com/bid/30651
Trust: 1.7
url:http://www.securitytracker.com/id?1020661
Trust: 1.7
url:http://www.securitytracker.com/id?1020662
Trust: 1.7
url:http://www.securitytracker.com/id?1020663
Trust: 1.7
url:http://secunia.com/advisories/31434
Trust: 1.7
url:http://www.securityfocus.com/archive/1/495397/100/0/threaded
Trust: 1.1
url:http://www.vupen.com/english/advisories/2008/2339
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/44393
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-3174
Trust: 0.9
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-3174
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/44393
Trust: 0.6
url:http://www.securityfocus.com/archive/1/archive/1/495397/100/0/threaded
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2008/2339
Trust: 0.6
url:http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=36559
Trust: 0.4
url:http://www.trapkit.de/advisories/tkadv2008-006.txt
Trust: 0.3
url:http://www.ca.com
Trust: 0.3
url:/archive/1/495427
Trust: 0.3
url:/archive/1/495397
Trust: 0.3
url:http://secunia.com/product/18834/
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/31434/
Trust: 0.1
url:http://secunia.com/product/12660/
Trust: 0.1
url:http://secunia.com/product/16198/
Trust: 0.1
url:http://secunia.com/hardcore_disassembler_and_reverse_engineer/
Trust: 0.1
url:http://secunia.com/product/19549/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/secunia_security_specialist/
Trust: 0.1
url:http://corporate.secunia.com/about_secunia/64/
Trust: 0.1
url:http://secunia.com/product/14434/
Trust: 0.1
url:https://support.ca.com/irj/portal/anonymous/solutionresults?aparno=ro00535&actionid=4
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://www.ca.com/us/privacy/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2008-2926
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2008-3174
Trust: 0.1
url:http://www.trapkit.de/
Trust: 0.1
url:http://support.ca.com/
Trust: 0.1
url:http://osvdb.org/
Trust: 0.1
url:http://shop.ca.com/support.
Trust: 0.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-2926
Trust: 0.1
url:https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentid=177782
Trust: 0.1
url:http://www.ca.com/us/contact/
Trust: 0.1
url:http://www.ca.com/us/legal/
Trust: 0.1
url:https://support.ca.com/irj/portal/anonymous/redirarticles?reqpage=search&se
Trust: 0.1
url:http://support.ca.com.
Trust: 0.1
url:https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentid=182496
Trust: 0.1
sources:
            
            
            VULHUB: VHN-33299 // 
            
            
            
            BID: 30651 // 
            
            
            
            JVNDB: JVNDB-2008-003251 // 
            
            
            
            PACKETSTORM: 68975 // 
            
            
            
            PACKETSTORM: 69034 // 
            
            
            
            CNNVD: CNNVD-200808-174 // 
            
            
            
            NVD: CVE-2008-3174

CREDITS
Tobias Klein, Elazar Broad
Trust: 0.9
sources:
            
            
            BID: 30651 // 
            
            
            
            CNNVD: CNNVD-200808-174

SOURCES
db:VULHUBid:VHN-33299
db:BIDid:30651
db:JVNDBid:JVNDB-2008-003251
db:PACKETSTORMid:68975
db:PACKETSTORMid:69034
db:CNNVDid:CNNVD-200808-174
db:NVDid:CVE-2008-3174

LAST UPDATE DATE
2025-04-10T23:05:19.791000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-33299date:2018-10-11T00:00:00
db:BIDid:30651date:2008-08-25T22:25:00
db:JVNDBid:JVNDB-2008-003251date:2012-06-26T00:00:00
db:CNNVDid:CNNVD-200808-174date:2008-09-11T00:00:00
db:NVDid:CVE-2008-3174date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE
db:VULHUBid:VHN-33299date:2008-08-12T00:00:00
db:BIDid:30651date:2008-08-11T00:00:00
db:JVNDBid:JVNDB-2008-003251date:2012-06-26T00:00:00
db:PACKETSTORMid:68975date:2008-08-13T01:46:19
db:PACKETSTORMid:69034date:2008-08-13T05:41:53
db:CNNVDid:CNNVD-200808-174date:2008-08-12T00:00:00
db:NVDid:CVE-2008-3174date:2008-08-12T23:41:00