SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Firewall)  >   Microsoft Internet Connection Firewall (ICF) Vendors:   Microsoft
Microsoft Windows Firewall User Interface May Not Properly Display Exception Rules
SecurityTracker Alert ID:  1014829
SecurityTracker URL:  http://securitytracker.com/id/1014829
CVE Reference:   CVE-2005-2765   (Links to External Site)
Updated:  Sep 2 2005
Original Entry Date:  Aug 31 2005
Impact:   Modification of system information
Vendor Confirmed:  Yes  

Description:   A security issue was reported in Microsoft Windows Firewall. The user interface may not properly display certain firewall configuration data from the registry.

The Windows Firewall User Interface does not properly display malformed entries from the Windows Registry. A local user with administrative privileges can create specially crafted Windows Firewall exception entries in the Windows Registry such that an exception will be created in the firewall but will not be displayed in the Windows Firewall User Interface.

Command line firewall administration tools (netsh firewall) can be used to properly view the exceptions.

Impact:   A local user with administrative privileges can create specially crafted Windows Firewall exception entries that will not be displayed in the Windows Firewall User Interface.
Solution:   No solution was available at the time of this entry. The vendor plans to issue a fix as part of a future service pack.

Some instructions on how to properly view the registry entries is available in the vendor's advisory at:

http://www.microsoft.com/technet/security/advisory/897663.mspx

Vendor URL:  www.microsoft.com/technet/security/advisory/897663.mspx (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (2003), Windows (XP)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC