Pedestal Software Security Notice

["Keith Woodard" <kwoodard () pedestalsoftware com>]

Product:   Integrity Protection Driver (IPD)
Version:   1.3 and earlier
Subject:   New Integrity Protection Driver (IPD) Available
Date:      January 3, 2003
Solution:  Upgrade to version 1.4

SUMMARY

    The Integrity Protection Driver (IPD) is an open source kernel
    driver for Windows NT and Windows 2000 that attempts to provide
    integrity to the Windows kernel by blocking kernel-altering
    device drivers, such as rootkits, from changing normal kernel
    function.

    A new version of the IPD has been released that corrects a
    vulnerability that circumvents the driver's protection.

    More information about the IPD, including its open source license,
    can be found at:

        http://www.pedestalsoftware.com/intact/ipd

DETAILS

    Phrack 59-16 provides sample code for circumventing the IPD using
    a kernel function, NtCreateSymbolicLinkObject and mapping a new
    name to \Device\PhysicalMemory. This specific use of
    NtCreateSymbolicLinkObject was fixed in version 1.3 of the
    IPD. However, Jan Rutkowski recently discovered that the same
    function can be used to map a directory to a drive letter through
    the use of the subst command. This could be used by a malicious
    user to circumvent IPD's protection of driver files.

PATCH AVAILABILITY

    Users of the IPD are urged to upgrade to the latest version.

    The latest driver and source code may be downloaded from the
    Pedestal Software web site at
    http://www.pedestalsoftware.com/intact/ipd.

CREDITS

    Thanks to Jan Rutkowski <jkrutkowski () elka pw edu pl> for
    telling us about this new vulnerability.

    Phrack 59-16 by crazylord <crazylord () minithins net>
    http://www.phrack.org/show.php?p=59&a=16

ABOUT PEDESTAL SOFTWARE

    Founded in 1998, Pedestal Software is "enabling the next wave of
    information security" by making the deployment, management, audit,
    and control of a security policy efficient and cost effective.
    The company is privately held and maintains its headquarters in
    Newton, Massachusetts. For additional information, please visit
    http://www.pedestalsoftware.com or contact us at (617) 928-5550.

DISCLAIMER

    Pedestal Software is not responsible for the misuse of any of the
    information provided on this website and/or through security
    advisories. This advisory is a service to Pedestal Software
    customers intended to promote secure installation and use of
    Pedestal Software products.