PT-2005-3788 · Microsoft · Antispyware

Published 2005-11-18 · Updated 2008-09-05 · CVE-2005-2940

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Antispyware version 1.0.509 (Beta 1)

Description The issue allows local users to potentially gain privileges through a malicious program.exe file in the C: folder. This involves several programs, including GIANTAntiSpywareMain.exe, gcASNotice.exe, gcasServ.exe, gcasSWUpdater.exe, and GIANTAntiSpywareUpdater.exe.

Recommendations For Microsoft Antispyware version 1.0.509 (Beta 1), consider restricting access to the C: folder to prevent malicious files from being executed, and avoid using unquoted Windows search paths until a fix is available.

Fix

Related Identifiers

CVE-2005-2940

Affected Products

Antispyware

References · 4

• http://idefense.com/application/poi/display?id=340&type=vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2940 · Security Note
• http://securityfocus.com/bid/15448 · Note
• http://securitytracker.com/id?1015226 · Note