PT-2019-19834 · G Data · G Data Total Security

Publicado 2019-03-13 · Atualizado 2020-08-24 · CVE-2019-9742

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions G Data Total Security versions prior to 2019-02-22

Description The issue allows an attacker to bypass Access Control Lists (ACLs) due to the lack of FILE DEVICE SECURE OPEN in Interpreted Device Characteristics. This leads to improper protection of files and directories within the .gdwfpcd device, resulting in potential unintended impersonation or object creation.

Recommendations For versions prior to 2019-02-22, update to a version released after 2019-02-22 to resolve the issue.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2019-9742

Produtos afetados

G Data Total Security

Referências · 4

• 🔥❌ https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-03-13-gdata-total-security-acl-bypass.md · Exploit, Deleted
• 🔥 https://nafiez.github.io/security/bypass/2019/03/12/gdata-total-security-acl-bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9742 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-9742 · Aviso do Fabricante