PT-2019-12281 · Avira · Avira Free Security Suite

Silton Santos · Publicado 2019-08-29 · Atualizado 2020-08-24 · CVE-2019-11396

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avira Free Security Suite version 10

Description An issue in Avira Free Security Suite allows unprivileged users to obtain SYSTEM privileges due to permissive access rights on the SoftwareUpdater folder. This can be exploited by creating pseudo-symbolic links to arbitrary files, which can be used to achieve arbitrary file creation when an update occurs. The privileged service sets access rights, offering write access to the Everyone group in any directory.

Recommendations For Avira Free Security Suite version 10, consider restricting access to the SoftwareUpdater folder and its configuration files to prevent unprivileged users from replacing files with pseudo-symbolic links until a fix is available. As a temporary workaround, restrict write access to the Everyone group in any directory to minimize the risk of exploitation.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2019-11396

Produtos afetados

Avira Free Security Suite

Referências · 5

• http://packetstormsecurity.com/files/153868/Avira-Free-Security-Suite-2019-Software-Updater-2.0.6.13175-Improper-Access-Control.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11396 · Nota de Segurança
• https://medium.com/sidechannel-br/vulnerabilidade-no-avira-security-suite-pode-levar-%C3%A0-escala%C3%A7%C3%A3o-de-privil%C3%A9gios-no-windows-71964236c077 · Nota
• https://seclists.org/fulldisclosure/2019/Aug/1 · Nota
• https://osv.dev/vulnerability/CVE-2019-11396 · Aviso do Fabricante