Avira AntiVir Personal Edition Classic Update.EXE Local Privilege Escalation Vulnerability

Bugtraq ID:	19889
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 07 2006 12:00AM
Updated:	Sep 08 2006 01:23AM
Credit:	Rugginello is credited with the discovery of this vulnerability.
Vulnerable:	free-av.de AntiVir Personal Edition Classic 7
Not Vulnerable:

Avira AntiVir Personal Edition Classic Update.EXE Local Privilege Escalation Vulnerability

AntiVir Personal Edition Classic is prone to a local privilege-escalation vulnerability.

A local attacker can exploit this issue to execute arbitrary code with SYSTEM privileges. This may facilitate a complete compromise of the affected computer.

AntiVir Personal Edition Classic version 7 is vulnerable; other versions may also be affected.

Avira AntiVir Personal Edition Classic Update.EXE Local Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

Avira AntiVir Personal Edition Classic Update.EXE Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Avira AntiVir Personal Edition Classic Update.EXE Local Privilege Escalation Vulnerability

References:

• AntiVir Personal Edition Classic Web Site (free-av.de)
  
• Avira Homepage (Avira)