PT-2006-5405 · Avira · Antivir Personaledition Classic

Published 2006-09-07 · Updated 2018-10-17 · CVE-2006-4619

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Avira AntiVir PersonalEdition Classic version 7.0 build 151

Description The issue allows local users to gain system privileges via a "Shatter" style attack. This can be achieved by exploiting the IParam parameter, and the PBM GETRANGE and PBM SETRANGE messages in an unspecified progress bar.

Recommendations For Avira AntiVir PersonalEdition Classic version 7.0 build 151, consider restricting access to the update.exe until a patch is available. As a temporary workaround, avoid using the IParam parameter in the affected update.exe to minimize the risk of exploitation. Additionally, restrict the use of the PBM GETRANGE and PBM SETRANGE messages in the unspecified progress bar to prevent potential attacks.

Fix

Related Identifiers

CVE-2006-4619

Affected Products

Antivir Personaledition Classic

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-4619 · Security Note
• http://securityfocus.com/bid/19843 · Note
• http://secunia.com/advisories/21764 · Note
• http://securityfocus.com/archive/1/445263/100/0/threaded · Note
• http://securityfocus.com/bid/19889 · Note
• http://securityfocus.com/archive/1/445205/100/0/threaded · Note