Vba32 Personal Antivirus Insecure File Permissions Local Privilege Escalation Vulnerability
BID:25930
Info
Vba32 Personal Antivirus Insecure File Permissions Local Privilege Escalation Vulnerability
| Bugtraq ID: | 25930 |
| Class: | Design Error |
| CVE: |
CVE-2007-5254 |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 04 2007 12:00AM |
| Updated: | May 07 2015 05:35PM |
| Credit: | Edi Strosar is credited with discovering this vulnerability. |
| Vulnerable: |
VirusBlokAda Vba32 Personal 3.12.2 VirusBlokAda VBA32 |
| Not Vulnerable: | |
Discussion
Vba32 Personal Antivirus Insecure File Permissions Local Privilege Escalation Vulnerability
Vba32 Personal is prone to a local privilege-escalation vulnerability that stems from a design error. This vulnerability occurs because the application assigns insecure file permissions to certain directories upon installation.
An attacker may exploit this vulnerability to overwrite files with arbitrary code in the affected directories. The arbitrary code will then run with SYSTEM-level privileges. This may facilitate a complete compromise of affected computers.
Vba32 Personal 3.12.2 is vulnerable to this issue; other versions may also be affected.
Vba32 Personal is prone to a local privilege-escalation vulnerability that stems from a design error. This vulnerability occurs because the application assigns insecure file permissions to certain directories upon installation.
An attacker may exploit this vulnerability to overwrite files with arbitrary code in the affected directories. The arbitrary code will then run with SYSTEM-level privileges. This may facilitate a complete compromise of affected computers.
Vba32 Personal 3.12.2 is vulnerable to this issue; other versions may also be affected.
Exploit / POC
Vba32 Personal Antivirus Insecure File Permissions Local Privilege Escalation Vulnerability
To exploit this issue, attackers replace executables that run as services with their own executable content.
To exploit this issue, attackers replace executables that run as services with their own executable content.
Solution / Fix
Vba32 Personal Antivirus Insecure File Permissions Local Privilege Escalation Vulnerability
Solution:
The vendor has released a fix to address this issue. Users of affected software should contact the vendor for information on obtaining and applying fixes.
Solution:
The vendor has released a fix to address this issue. Users of affected software should contact the vendor for information on obtaining and applying fixes.
References
Vba32 Personal Antivirus Insecure File Permissions Local Privilege Escalation Vulnerability
References:
References: