CVE-2006-5153

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-10-05 · updated 2026-06-16

Description

The (1) fwdrv.sys and (2) khips.sys drivers in Sunbelt Kerio Personal Firewall 4.3.268 and earlier do not validate arguments passed through to SSDT functions, including NtCreateFile, NtDeleteFile, NtLoadDriver, NtMapViewOfSection, NtOpenFile, and NtSetInformationFile, which allows local users to cause a denial of service (crash) and possibly other impacts via unspecified vectors.

Affected products

Kerio Personal Firewall: 4.0.6, 4.0.7, 4.0.8, 4.0.9, 4.0.10, 4.0.11 (+12)

References

http://secunia.com/advisories/22234
http://securityreason.com/securityalert/1685
http://securitytracker.com/id?1016967
http://www.matousec.com/info/advisories/Kerio-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.php
http://www.securityfocus.com/archive/1/447504/100/0/threaded
http://www.securityfocus.com/bid/20299
http://www.vupen.com/english/advisories/2006/3872
https://exchange.xforce.ibmcloud.com/vulnerabilities/29313
http://secunia.com/advisories/22234
http://securityreason.com/securityalert/1685
http://securitytracker.com/id?1016967
http://www.matousec.com/info/advisories/Kerio-Multiple-insufficient-argument-validation-of-hooked-SSDT-functions.php

Get alerted when CVE-2006-5153 or the next vulnerability affects your stack