iDEFENSE has reported two vulnerabilities in StackDefender, which potentially can be exploited by malicious people to crash a system protected by StackDefender.

1) A pointer dereference error when handling the "BaseAddress" argument for the "ZwProtectVirtualMemory" and "ZwAllocateVirtualMemory" APIs may crash the system if an invalid pointer is passed.

This vulnerability has been reported in version 2.0.

2) A pointer dereference error when handling the "ObjectAttributes" argument for the "ZwOpenFile" and "ZwCreateFile" APIs may crash the system if an invalid pointer is passed.

This vulnerability has been reported in version 1.10.

Successful exploitation of the two vulnerabilities requires that a malicious person has an attack vector (e.g another vulnerability) to an affected system, which will be blocked by StackDefender.

Solution
Update to StackDefender 2.10:
Further details available to Secunia VIM customers

Provided and/or discovered by
Peter Silberman, iDEFENSE Labs.

Original Advisory
iDEFENSE:
http://www.idefense.com/application/poi/display?id=118&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=119&type=vulnerabilities

Deep Links
Links available to Secunia VIM customers