Panda Platinum Internet Security 2006/2007 Local Privilege Escalation Vulnerability

Bugtraq ID:	19891
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 07 2006 12:00AM
Updated:	Sep 08 2006 03:52PM
Credit:	3APA3A is credited with discovering this vulnerability.
Vulnerable:	Panda Platinum 2007 Internet Security 0 Panda Platinum 2006 Internet Security
Not Vulnerable:

Panda Platinum Internet Security 2006/2007 Local Privilege Escalation Vulnerability

Panda Platinum Internet Security 2006/2007 products are prone to a local privilege-escalation vulnerability because of a design error. This vulnerability occurs because the application assigns insecure file permissions to certain directories upon installation.

An attacker may exploit this vulnerability to overwrite executables with arbitrary code in the affected directories to be executed with LocalSystem-level privileges. This may facilitate a complete compromise of affected computers.

Panda Platinum Internet Security 2006/2007 Local Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

Panda Platinum Internet Security 2006/2007 Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Panda Platinum Internet Security 2006/2007 Local Privilege Escalation Vulnerability

References:

• Panda Platinum Internet Security 2006/2007 privilege ([email protected])
  
• Panda Software Homepage (Panda Software)
  
• Panda Platinum Internet Security privilege escalation / bayesian filter control ([email protected])