PT-2019-14863 · Pcprotect · Pcprotect Anti-Virus

Flipfl0P · Publicado 2019-10-07 · Atualizado 2020-08-24 · CVE-2019-16913

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PC Protect Antivirus version 4.14.31

Description The issue concerns weak folder permissions in the default installation directory of PC Protect Antivirus, allowing any user to modify the contents of the directory and its subfolders. Additionally, the program installs a service called SecurityService that runs as LocalSystem, which can be exploited to escalate privileges to NT AUTHORITYSYSTEM by substituting the service's binary with a malicious file.

Recommendations For PC Protect Antivirus version 4.14.31, consider restricting access to the installation directory and its subfolders to prevent unauthorized modifications. As a temporary workaround, restrict access to the SecurityService to minimize the risk of privilege escalation.

Exploit

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2019-16913

Produtos afetados

Pcprotect Anti-Virus

Referências · 3

• 🔥 https://flipflopsecurity.wordpress.com/2019/10/07/pc-protect-v4-14-31-privilege-esclation · Exploit
• https://osv.dev/vulnerability/CVE-2019-16913 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16913 · Nota de Segurança