Description
Computer Associates Host Intrusion Prevention System (HIPS) drivers (1) Core kmxstart.sys 6.5.4.31 and (2) Firewall kmxfw.sys 6.5.4.10 allow local users to gain privileges by using certain privileged IOCTLs to modify callback function pointers.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Computer Associates Personal Firewall 9.0 - HIPS Driver 'kmxfw.sys' Local Privilege Escalation EDB-29069 · local · Nov 16, 2006 · verified
- Computer Associates Personal Firewall 9.0 - HIPS Driver 'kmxstart.sys' Local Privilege Escalation EDB-29070 · local · Nov 16, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?cid=97729
- 20061121 RE: [Reversemode advisory] Computer Associates HIPS Drivers - multiple local privilege escalation vulnerabilities. mailing-list
- 21140 vdb-entry
- 30497 vdb-entry
- 20061116 [Reversemode advisory] Computer Associates HIPS Drivers - multiple local privilege escalation vulnerabilities. mailing-list
- 22972 third-party-advisory
- 30498 vdb-entry
- http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34818
- 20070124 [CAID 34818]: CA Personal Firewall Multiple Privilege Escalation Vulnerabilities mailing-list
- http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=38