PT-2018-18140 · Totalav · Totalav

Filipe Xavier Oliveira · Publicado 2018-07-13 · Atualizado 2019-10-03 · CVE-2018-7535

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TotalAV version 4.1.7

Description An issue was discovered that allows an unprivileged user to modify or overwrite all of the product's files due to weak permissions under %PROGRAMFILES%. This weakness enables local users to gain privileges or obtain maximum control over the product.

Recommendations For TotalAV version 4.1.7, consider restricting access to the product's files under %PROGRAMFILES% to prevent local users from modifying or overwriting them, until a fix is available.

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2018-7535

Produtos afetados

Totalav

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-7535 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7535 · Nota de Segurança
• http://seclists.org/fulldisclosure/2018/Jul/54 · Nota