CVE-2007-1793 in Norton Internet Security
Summary
by MITRE
SPBBCDrv.sys in Symantec Norton Personal Firewall 2006 9.1.0.33 and 9.1.1.7 does not validate certain arguments before being passed to hooked SSDT function handlers, which allows local users to cause a denial of service (crash) or possibly execute arbitrary code via crafted arguments to the (1) NtCreateMutant and (2) NtOpenEvent functions. NOTE: it was later reported that Norton Internet Security 2008 15.0.0.60, and possibly other versions back to 2006, are also affected.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2019
The vulnerability described in CVE-2007-1793 represents a critical kernel-mode flaw in Symantec Norton Personal Firewall versions 9.1.0.33 and 9.1.1.7, with subsequent reporting indicating broader impact through Norton Internet Security 2008 version 15.0.0.60 and potentially earlier versions. This issue stems from improper argument validation within the SPBBCDrv.sys kernel driver component that handles system service descriptor table (SSDT) function interception. The vulnerability specifically affects two Windows native API functions: NtCreateMutant and NtOpenEvent, which are fundamental system calls used for process synchronization and inter-process communication. The root cause lies in the driver's failure to properly validate input parameters before passing them to the hooked SSDT handlers, creating an exploitable condition that can be leveraged by local attackers.
The technical exploitation of this vulnerability occurs through the manipulation of arguments passed to the NtCreateMutant and NtOpenEvent system calls, which are intercepted by the vulnerable Symantec driver. When these functions are invoked with crafted parameters, the driver's argument validation mechanisms fail to properly sanitize the inputs, allowing maliciously constructed arguments to be processed directly by the hooked SSDT handlers. This lack of input validation creates a potential code execution or denial of service condition, as the kernel driver cannot properly handle malformed or unexpected parameters. The vulnerability is particularly concerning because it operates at the kernel level where privilege escalation is not required, and the impact can be severe enough to cause system crashes or potentially allow arbitrary code execution with kernel privileges.
From an operational standpoint, this vulnerability presents significant risk to systems running affected Symantec products, as local attackers with minimal privileges can exploit the flaw to either crash the operating system or potentially execute malicious code with kernel-level privileges. The attack vector requires local system access, making it less severe than remote exploits but still dangerous in environments where privilege escalation is possible or where attackers might gain local access through other means. The impact extends beyond just the immediate denial of service or code execution, as it can compromise the integrity of the security software itself, potentially leaving systems more vulnerable to other attacks or making the firewall ineffective at protecting against malicious activity.
The vulnerability aligns with CWE-129, which describes improper validation of input buffers, and represents a classic example of insufficient input validation in kernel-mode drivers. From an ATT&CK perspective, this vulnerability maps to T1068, which covers the exploitation of remote services, and T1543, related to hijacking system processes. The flaw demonstrates poor defensive programming practices in kernel drivers, where the principle of least privilege and input sanitization should be strictly enforced. Organizations should implement immediate patching of affected Symantec products, as well as conduct thorough vulnerability assessments of other security software components that might exhibit similar kernel-mode argument validation issues. System administrators should also consider implementing additional monitoring for abnormal system behavior that might indicate exploitation attempts, particularly around the NtCreateMutant and NtOpenEvent system calls, and ensure that all security software components are regularly updated to prevent similar vulnerabilities from being exploited in the future.