[NT] Prevx Pro Multiple Vulnerabilities (File Protection Bypass, Command Bypass)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Prevx Pro Multiple Vulnerabilities (File Protection Bypass, Command 
Bypass)
------------------------------------------------------------------------


SUMMARY

" <http://www.prevx.com/> Prevx Pro utilizes the latest behavior based 
intrusion prevention technology." By using memory mapping it is possible 
to access the programs that PrevX protects. In addition, by sending 
invalid information it is possible to tell PrevX to allow a malicious 
program to penetrate the system.

DETAILS

Vulnerable Systems:
 * Prevx Pro IPS 2005

File Protection Bypass:
PrevX by default protected many critical files of the system. However, the 
protection can be bypassed by using memory mapping. For example, to edit 
winnt/win.ini file, open the file and do mapviewoffile, and then edit the 
file from the memory. PrevX does not protect files being edited from 
memory mapping IO.

Command Bypass:
PrevX kernel driver and the user-space applications talking with each 
other by using NtDeviceIoControlFile. However, it seems the driver doesn't 
check whether or not the user-application is from PrevX or not. It is 
possible to bypass the protection by pretending a user send an "allow" 
command down to the kernel driver every time a warning message is popping 
up.


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> Tri 
Huynh.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.