PT-2009-5126 · Avira+1 · Avira Antivir+4

Published 2009-08-13 · Updated 2017-08-17 · CVE-2009-2761

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Avira AntiVir, AntiVir Premium, Premium Security Suite, and AntiVir Professional (affected versions not specified)

Description The issue is related to an unquoted Windows search path vulnerability in the scheduler (sched.exe) that might allow local users to gain privileges. This could be achieved via a malicious antivir.exe file placed in the "C:Program Filesavira" directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2009-2761

Affected Products

Antivir Premium

Antivir Professional

Avira Antivir

Premium Security Suite

Windows

References · 6

• http://vupen.com/english/advisories/2008/3130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2761 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2009-01/0146.html · Note
• http://blog.zoller.lu/2009/01/tzo-2009-2-avira-antivir-priviledge.html · Note
• http://osvdb.org/55647 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46568 · Note