Kerio Fake ‘iphlpapi’ DLL injection Vulnerability

A vulnerability in the Kerio allows local attackers to cause the product to load an arbitrary DLL which in turn can be used to compromise the system.

Vulnerable software:
 * Sunbelt Kerio Personal Firewall 4.3.268
 * Sunbelt Kerio Personal Firewall 4.3.246
 * probably all versions of Sunbelt Kerio Personal Firewall 4
 * possibly older versions of Sunbelt Kerio Personal Firewall

When Sunbelt Kerio Personal Firewall (SKPF) loads dependent modules, it relies on the operating system. System library iphlpapi.dll is located in the system directory but the main SKPF service, which requires and loads this DLL, is located in the installation directory of SKPF. This is why it tries to find iphlpapi.dll in its installation directory at first and then, if it is not found in this directory, it tries to find it in the system directory. Moreover, it is possible to create new files in the installation directory of SKPF. A malicious application can create a fake iphlpapi.dll in the installation directory of SKPF, which will be loaded by the operating system into the SKPF service during its initialization. This is how the malicious application is able to execute an arbitrary code inside SKPF service and bypass any of its security mechanisms.

 * 2006-01-05: Candidate for inclusion in the CVE list
 * 2006-01-04: Vulnerability confirmed by popular information sources
 * 2007-01-01: Advisory released
 * 2006-08-12: Vendor notification
The information has been provided by Matousec – Transparent security Research.
The original article can be found at: 


Leave a Reply