CVE-2007-5047 in Norton Internet Security
Summary
by MITRE
Norton Internet Security 2008 15.0.0.60 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers, which allows local users to cause a denial of service (crash) and possibly gain privileges via the NtOpenSection kernel SSDT hook. NOTE: the NtCreateMutant and NtOpenEvent function hooks are already covered by CVE-2007-1793.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/01/2017
The vulnerability described in CVE-2007-5047 represents a critical kernel-level flaw in Norton Internet Security 2008 version 15.0.0.60 that stems from improper parameter validation within the System Service Descriptor Table (SSDT) function handlers. This issue specifically affects the NtOpenSection kernel function hook, creating a dangerous condition where local attackers can exploit the insufficient validation mechanisms to manipulate kernel operations. The vulnerability operates at the core of Windows kernel security architecture, where SSDT hooks serve as the primary mechanism for system call interception and monitoring by security software. When Norton Internet Security installs its kernel-level drivers, it establishes hooks into the SSDT to monitor and control system calls, but fails to properly validate input parameters passed to these hooks, creating an exploitable entry point for privilege escalation and system instability.
The technical flaw manifests through the improper handling of parameters in the NtOpenSection SSDT hook implementation, which allows attackers to craft malicious input that bypasses normal kernel validation procedures. This vulnerability falls under CWE-20, "Improper Input Validation," and specifically relates to kernel-mode security flaws that can be exploited to gain unauthorized access to system resources. The attack vector requires local system access, making it particularly concerning as it can be exploited by users who already have a foothold on the system. The vulnerability enables both denial of service conditions through kernel crashes and potential privilege escalation, as the flawed validation allows attackers to manipulate the kernel's behavior in ways that could lead to elevated system privileges. This represents a classic case of insufficient kernel-level input sanitization where the security software itself becomes a vector for exploitation rather than a protective barrier.
The operational impact of CVE-2007-5047 extends beyond simple system crashes to potentially enable full system compromise when combined with other exploitation techniques. Local attackers who successfully exploit this vulnerability can cause the system to become unstable through kernel crashes, disrupting normal operations and potentially creating denial of service conditions that could be leveraged for further attacks. The privilege escalation aspect of this vulnerability is particularly dangerous as it could allow attackers to gain kernel-level privileges, effectively breaking the fundamental security model of Windows operating systems. This vulnerability is categorized under the ATT&CK technique T1068, "Exploitation for Privilege Escalation," and T1499, "Endpoint Denial of Service," demonstrating its dual threat nature. The fact that this vulnerability affects a widely deployed security solution like Norton Internet Security 2008 makes it especially concerning, as it can be exploited in environments where security software is trusted to provide protection against such attacks.
Mitigation strategies for CVE-2007-5047 should focus on immediate patching of the affected Norton Internet Security 2008 version, as well as implementing additional security controls to limit local access privileges. Organizations should consider disabling unnecessary kernel-level hooks and monitoring for suspicious system call patterns that could indicate exploitation attempts. The vulnerability highlights the importance of proper input validation in kernel-mode drivers and serves as a reminder that security software itself can become a target for exploitation. System administrators should also implement monitoring solutions that can detect abnormal kernel behavior and ensure that all security software is kept up to date with the latest security patches. The vulnerability demonstrates the critical nature of kernel-level security testing and validation, as flaws in security software can create dangerous situations where the protective mechanisms become the attack surface rather than the defense mechanism.