AVG Anti-Virus Local Privilege Escalation Vulnerability

Bugtraq ID:	24870
Class:	Design Error
CVE:	CVE-2007-3777
Remote:	No
Local:	Yes
Published:	Jul 11 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Jonathan Lindsay <john-lindsay ngssoftware com> discovered this issue.
Vulnerable:	AVG AVG Anti-Virus Free Edition 7.5.446 AVG AVG Anti-Virus 7.5.448
Not Vulnerable:	AVG AVG Anti-Virus 7.5.476

AVG Anti-Virus Local Privilege Escalation Vulnerability

AVG Anti-Virus is prone to a local privilege-escalation vulnerability because the application fails to properly limit unprivileged users from functionality that allows them to write arbitrary data to arbitrary kernel memory.

Successfully exploiting this issue allows local attackers to gain SYSTEM-level privileges, facilitating the complete compromise of affected computers.

AVG Anti-Virus Free Edition 7.5.446 and AVG Anti-Virus 7.5.438 are vulnerable; other versions may also be affected.

AVG Anti-Virus Local Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

AVG Anti-Virus Local Privilege Escalation Vulnerability

Solution:
The vendor has released fixes for this issue. Users of affected packages should contact the vendor for information about obtaining and applying fixes.

AVG Anti-Virus Local Privilege Escalation Vulnerability

References:

• AVG Anti-Virus Free Edition Product Page (Grisoft)
  
• AVG Anti-Virus Professional Edition (full version) (Grisoft)
  
• Advisory: Arbitrary kernel mode memory writes in AVG ([email protected])