NVD

Id
62365  
Name
CVE-2006-3697  
Description
Agnitum Outpost Firewall Pro 3.51.759.6511 (462), as used in (1) Lavasoft Personal Firewall 1.0.543.5722 (433) and (2) Novell BorderManager Novell Client Firewall 2.0, does not properly restrict user activities in application windows that run in a LocalSystem context, which allows local users to gain privileges and execute commands (a) via the "open folder" option when no instance of explorer.exe is running, possibly related to the ShellExecute API function; or (b) by overwriting a batch file through the "Save Configuration As" option. NOTE: this might be a vulnerability in Microsoft Windows and explorer.exe instead of the firewall.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2016-12-20  
Published
2006-07-21  
Modified Date
2011-08-25  
Seq
2006-3697  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
323273 62365 CVE-2006-3697 http://www.ben.goulding.com.au/secad.html  View
323274 62365 CVE-2006-3697 20060716 Escalation of privileges in Outpost and Lavasoft Firewalls -Unusual ShellExecute behavior  View
323275 62365 CVE-2006-3697 19018  View
323276 62365 CVE-2006-3697 19024  View
323277 62365 CVE-2006-3697 ADV-2006-2851  View
323278 62365 CVE-2006-3697 ADV-2006-2852  View
323279 62365 CVE-2006-3697 ADV-2007-0144  View
323280 62365 CVE-2006-3697 https://secure-support.novell.com/KanisaPlatform/Publishing/903/3762108_f.SAL_Public.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
60553 JVNDB-2006-002819 Lavasoft Personal Firewall などの製品で使用される Agnitum Outpost Firewall における権限を取得される脆弱性 (1) Lavasoft Personal Firewall および (2) Novell BorderManager Novell Client Firewall で使用される Agnitum Outpost Firewall は、LocalSystem のコンテキストで稼動するアプリケーションウインドウ内のユーザの活動を適切に制限しない、および ShellExecute API 関数に関する処理に不備があるため、権限を取得される、およびコマンドを実行される脆弱性が存在します。 CVE-2006-3697 19799 CVE-2006-3697 62365 7.2 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-002819.html 2006-07-21 2012-12-20 View