Description
Comodo Personal Firewall 2.3.6.81 relies on the Process Environment Block (PEB) to identify a process, which allows local users to bypass the product's controls on a process by spoofing the (1) ImagePathName, (2) CommandLine, and (3) WindowTitle fields in the PEB.
References (4)
Core 4
Core References
Various Sources x_refsource_misc
http://www.matousec.com/downloads/windows-personal-firewall-analysis/ex-coat.zip
Vendor Advisory x_refsource_misc
http://www.matousec.com/info/advisories/Bypassing-process-identification-serveral-personal-firewalls-HIPS.php
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/454522/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/21615
Scores
EPSS
0.0006
EPSS Percentile
18.2%
Details
Status
published
Products (6)
avg/antivirus_plus_firewall
7.5.431
comodo/comodo_personal_firewall
2.3.6.81
filseclab/personal_firewall
3.0.8686
infoprocess/antihook
3.0.23
soft4ever/look_n_stop
2.05p2
symantec/sygate_personal_firewall
5.6.2808
Published
Dec 18, 2006
Tracked Since
Feb 18, 2026