Vulnerabilites related to checkpoint - zonealarm_extreme_security
Vulnerability from fkie_nvd
Published
2020-07-06 18:15
Modified
2024-11-21 05:34
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute code at elevated privileges through a combination of file permission manipulation and exploitation of Windows CVE-2020-00896 on unpatched systems.
References
cve@checkpoint.comhttps://www.zonealarm.com/software/extreme-security/release-historyRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zonealarm.com/software/extreme-security/release-historyRelease Notes, Vendor Advisory
Impacted products
Vendor Product Version
checkpoint zonealarm_extreme_security *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkpoint:zonealarm_extreme_security:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "688CADBA-75DA-4F8C-B25E-AB7279A77CCD",
              "versionEndExcluding": "15.8.109.18436",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute code at elevated privileges through a combination of file permission manipulation and exploitation of Windows CVE-2020-00896 on unpatched systems."
    },
    {
      "lang": "es",
      "value": "Los productos ZoneAlarm Firewall y Antivirus anteriores a versi\u00f3n 15.8.109.18436, permiten a un atacante que ya posee acceso al sistema ejecutar c\u00f3digo con privilegios elevados por medio de una combinaci\u00f3n de manipulaci\u00f3n de permisos de archivos y explotaci\u00f3n de Windows CVE-2020-00896 en sistemas sin parches"
    }
  ],
  "id": "CVE-2020-6013",
  "lastModified": "2024-11-21T05:34:58.930",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-07-06T18:15:21.230",
  "references": [
    {
      "source": "cve@checkpoint.com",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://www.zonealarm.com/software/extreme-security/release-history"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://www.zonealarm.com/software/extreme-security/release-history"
    }
  ],
  "sourceIdentifier": "cve@checkpoint.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-65"
        }
      ],
      "source": "cve@checkpoint.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2012-08-25 21:55
Modified
2025-04-11 00:51
Severity ?
Summary
Race condition in ZoneAlarm Extreme Security 9.1.507.000 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute
References
cve@mitre.orghttp://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html
cve@mitre.orghttp://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html
cve@mitre.orghttp://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/
cve@mitre.orghttp://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php
cve@mitre.orghttp://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php
cve@mitre.orghttp://www.f-secure.com/weblog/archives/00001949.html
cve@mitre.orghttp://www.osvdb.org/67660
cve@mitre.orghttp://www.securityfocus.com/bid/39924
cve@mitre.orghttp://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html
af854a3a-2127-422b-91ae-364da2661108http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/
af854a3a-2127-422b-91ae-364da2661108http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php
af854a3a-2127-422b-91ae-364da2661108http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php
af854a3a-2127-422b-91ae-364da2661108http://www.f-secure.com/weblog/archives/00001949.html
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/67660
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/39924
af854a3a-2127-422b-91ae-364da2661108http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/
Impacted products
Vendor Product Version
checkpoint zonealarm_extreme_security 9.1.507.000
microsoft windows_xp *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkpoint:zonealarm_extreme_security:9.1.507.000:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD802BAB-9667-4EBE-8975-01B2E043B127",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E61F1C9B-44AF-4B35-A7B2-948EEF7639BD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [
    {
      "sourceIdentifier": "cve@mitre.org",
      "tags": [
        "disputed"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Race condition in ZoneAlarm Extreme Security 9.1.507.000 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute"
    },
    {
      "lang": "es",
      "value": "** EN DISPUTA ** Condici\u00f3n de carrera en ZoneAlarm Extreme Security v9.1.507.000 sobre Windows XP permite a usuarios locales evitar kernel-mode hook handlers, y ejecutar c\u00f3digo peligroso que podr\u00eda entre otras cosas ser bloqueado por un manejador pero no bloqueado por un detector de malware signature-based, a trav\u00e9s de ciertos user-space cambios de memoria  durante la ejecuci\u00f3n de hook-handler execution, tambi\u00e9n conocido como un ataque argument-switch o KHOBE. NOTA: esta  problema est\u00e1 en disputa por terceras partes."
    }
  ],
  "id": "CVE-2010-5184",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 1.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-08-25T21:55:04.023",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.f-secure.com/weblog/archives/00001949.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/67660"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/39924"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.f-secure.com/weblog/archives/00001949.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/67660"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/39924"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2024-11-22 20:15
Modified
2025-08-15 17:24
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Forensic Recorder service. By creating a symbolic link, an attacker can abuse the service to overwrite arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21677.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1036/Third Party Advisory
Impacted products
Vendor Product Version
checkpoint zonealarm_extreme_security 4.0.148.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkpoint:zonealarm_extreme_security:4.0.148.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C643F10-BF5E-45D6-ADA9-AE0EFEE548A5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Forensic Recorder service. By creating a symbolic link, an attacker can abuse the service to overwrite arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21677."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de escalada de privilegios locales en Check Point ZoneAlarm Extreme Security. Esta vulnerabilidad permite a los atacantes locales escalar privilegios en las instalaciones afectadas de Check Point ZoneAlarm Extreme Security. Un atacante primero debe obtener la capacidad de ejecutar c\u00f3digo con pocos privilegios en el sistema de destino para explotar esta vulnerabilidad. La falla espec\u00edfica existe dentro del servicio Forensic Recorder. Al crear un enlace simb\u00f3lico, un atacante puede abusar del servicio para sobrescribir archivos arbitrarios. Un atacante puede aprovechar esta vulnerabilidad para escalar privilegios y ejecutar c\u00f3digo arbitrario en el contexto de SYSTEM. Era ZDI-CAN-21677."
    }
  ],
  "id": "CVE-2024-6233",
  "lastModified": "2025-08-15T17:24:50.950",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-11-22T20:15:11.437",
  "references": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1036/"
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ],
      "source": "zdi-disclosures@trendmicro.com",
      "type": "Secondary"
    }
  ]
}

CVE-2024-6233 (GCVE-0-2024-6233)
Vulnerability from cvelistv5
Published
2024-11-22 20:05
Modified
2024-11-22 20:55
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Summary
Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Forensic Recorder service. By creating a symbolic link, an attacker can abuse the service to overwrite arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21677.
References
Impacted products
Vendor Product Version
Check Point ZoneAlarm Extreme Security Version: 4.0.148.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:check_point:zonealarm_extreme_security:4.0.148.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "zonealarm_extreme_security",
            "vendor": "check_point",
            "versions": [
              {
                "status": "affected",
                "version": "4.0.148.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6233",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-22T20:43:03.859640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-22T20:55:29.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "ZoneAlarm Extreme Security",
          "vendor": "Check Point",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.148.0"
            }
          ]
        }
      ],
      "dateAssigned": "2024-06-20T16:51:41.939-05:00",
      "datePublic": "2024-07-31T16:19:51.078-05:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Forensic Recorder service. By creating a symbolic link, an attacker can abuse the service to overwrite arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21677."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-22T20:05:39.766Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-24-1036",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1036/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Filip Dragovic (@filip_dragovic)"
      },
      "title": "Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2024-6233",
    "datePublished": "2024-11-22T20:05:39.766Z",
    "dateReserved": "2024-06-20T21:51:41.913Z",
    "dateUpdated": "2024-11-22T20:55:29.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-6013 (GCVE-0-2020-6013)
Vulnerability from cvelistv5
Published
2020-07-06 17:54
Modified
2024-08-04 08:47
Severity ?
CWE
Summary
ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute code at elevated privileges through a combination of file permission manipulation and exploitation of Windows CVE-2020-00896 on unpatched systems.
References
Impacted products
Vendor Product Version
n/a Check Point ZoneAlarm Version: before 15.8.109.18436
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:47:41.024Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zonealarm.com/software/extreme-security/release-history"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Check Point ZoneAlarm",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "before 15.8.109.18436"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute code at elevated privileges through a combination of file permission manipulation and exploitation of Windows CVE-2020-00896 on unpatched systems."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-65",
              "description": "CWE-65: Windows Hard Link",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-06T17:54:48",
        "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
        "shortName": "checkpoint"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zonealarm.com/software/extreme-security/release-history"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@checkpoint.com",
          "ID": "CVE-2020-6013",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Check Point ZoneAlarm",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 15.8.109.18436"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute code at elevated privileges through a combination of file permission manipulation and exploitation of Windows CVE-2020-00896 on unpatched systems."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-65: Windows Hard Link"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zonealarm.com/software/extreme-security/release-history",
              "refsource": "MISC",
              "url": "https://www.zonealarm.com/software/extreme-security/release-history"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
    "assignerShortName": "checkpoint",
    "cveId": "CVE-2020-6013",
    "datePublished": "2020-07-06T17:54:48",
    "dateReserved": "2020-01-07T00:00:00",
    "dateUpdated": "2024-08-04T08:47:41.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-5184 (GCVE-0-2010-5184)
Vulnerability from cvelistv5
Published
2012-08-25 21:00
Modified
2024-09-16 17:39
Severity ?
CWE
  • n/a
Summary
Race condition in ZoneAlarm Extreme Security 9.1.507.000 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:09:39.295Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
          },
          {
            "name": "39924",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/39924"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
          },
          {
            "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
          },
          {
            "name": "67660",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/67660"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.f-secure.com/weblog/archives/00001949.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Race condition in ZoneAlarm Extreme Security 9.1.507.000 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-08-25T21:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
        },
        {
          "name": "39924",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/39924"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
        },
        {
          "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
        },
        {
          "name": "67660",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/67660"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.f-secure.com/weblog/archives/00001949.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-5184",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "** DISPUTED ** Race condition in ZoneAlarm Extreme Security 9.1.507.000 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
            },
            {
              "name": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/",
              "refsource": "MISC",
              "url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/"
            },
            {
              "name": "39924",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/39924"
            },
            {
              "name": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php",
              "refsource": "MISC",
              "url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
            },
            {
              "name": "20100505 KHOBE - 8.0 earthquake for Windows desktop security software",
              "refsource": "FULLDISC",
              "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
            },
            {
              "name": "67660",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/67660"
            },
            {
              "name": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/",
              "refsource": "MISC",
              "url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/"
            },
            {
              "name": "http://www.f-secure.com/weblog/archives/00001949.html",
              "refsource": "MISC",
              "url": "http://www.f-secure.com/weblog/archives/00001949.html"
            },
            {
              "name": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php",
              "refsource": "MISC",
              "url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-5184",
    "datePublished": "2012-08-25T21:00:00Z",
    "dateReserved": "2012-08-25T00:00:00Z",
    "dateUpdated": "2024-09-16T17:39:07.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}