Multiple Panda Products Insecure Program File Permissions Local Privilege Escalation Vulnerability
BID:36897
Info
Multiple Panda Products Insecure Program File Permissions Local Privilege Escalation Vulnerability
| Bugtraq ID: | 36897 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 02 2009 12:00AM |
| Updated: | Nov 12 2009 04:36PM |
| Credit: | Francis Provencher from Protek Research Labs |
| Vulnerable: |
Panda Internet Security 2010 Panda Global Protection 2010 Panda Antivirus Pro 2010 |
| Not Vulnerable: | |
Discussion
Multiple Panda Products Insecure Program File Permissions Local Privilege Escalation Vulnerability
Multiple Panda Security products are prone to a local privilege-escalation vulnerability.
A local attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges, resulting in a complete compromise of the affected computer.
The following products are affected:
Panda Global Protection 2010
Panda Internet Security 2010
NOTE: This issue appears to be related to the vulnerability described by BID 19891 (Panda Platinum Internet Security 2006/2007 Local Privilege Escalation Vulnerability).
Multiple Panda Security products are prone to a local privilege-escalation vulnerability.
A local attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges, resulting in a complete compromise of the affected computer.
The following products are affected:
Panda Global Protection 2010
Panda Internet Security 2010
NOTE: This issue appears to be related to the vulnerability described by BID 19891 (Panda Platinum Internet Security 2006/2007 Local Privilege Escalation Vulnerability).
Exploit / POC
Multiple Panda Products Insecure Program File Permissions Local Privilege Escalation Vulnerability
An attacker can use readily available command-line utilities to exploit this issue.
An attacker can use readily available command-line utilities to exploit this issue.
Solution / Fix
Multiple Panda Products Insecure Program File Permissions Local Privilege Escalation Vulnerability
Solution:
Updates are available. Please see the references for details.
Panda Internet Security 2010
Panda Antivirus Pro 2010
Panda Global Protection 2010
Solution:
Updates are available. Please see the references for details.
Panda Internet Security 2010
-
Panda hfp150906s19_r1.exe
http://www.pandasecurity.com/resources/sop/PIS10/hfp150906s19_r1.exe
Panda Antivirus Pro 2010
-
Panda hft90906s15_r1.exe
http://www.pandasecurity.com/resources/sop/PAVPro10/hft90906s15_r1.exe
Panda Global Protection 2010
-
Panda hfgp30910s1_r7.exe
http://www.pandasecurity.com/resources/sop/PGP10/hfgp30910s1_r7.exe
References
Multiple Panda Products Insecure Program File Permissions Local Privilege Escalation Vulnerability
References:
References:
- Hotfix Retail 2010: Problems with local privilege escalation (Panda)
- Vendor Homepage (Panda)
- {PRL} Multiple Panda Security Products Local Privilege Escalation Vulnerability (Protek Research Lab
- Panda Security Software Local Privilege Escalation ([email protected] (Maxim A. Kulakov))
- Re: {PRL} Multiple Panda Security Products Local Privilege Escalation Vulnerabil ("Vladimir '3APA3A' Dubrovin" <[email protected]>)