PT-2009-6573 · Kaspersky · Kaspersky Internet Security+2

Maxim A. Kulakov + 1 · Published 2009-12-29 · Updated 2018-10-10 · CVE-2009-4452

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus versions 5.0 through 9.0.0.463 Kaspersky Antivirus Personal version 5.0.x Kaspersky Internet Security versions 7.0.1.325 through 9.0.0.463

Description The issue allows local users to gain SYSTEM privileges by exploiting weak permissions set for the BASES directory. This can be achieved by replacing an executable or DLL with a Trojan horse, potentially leading to elevated access.

Recommendations For Kaspersky Anti-Virus versions 5.0 through 9.0.0.463, consider restricting access to the BASES directory to prevent local users from replacing executables or DLLs with malicious files. For Kaspersky Antivirus Personal version 5.0.x, restrict access to the BASES directory to minimize the risk of exploitation. For Kaspersky Internet Security versions 7.0.1.325 through 9.0.0.463, limit access to the BASES directory to prevent unauthorized modifications.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-4452

Affected Products

Kaspersky Anti-Virus

Kaspersky Antivirus Personal

Kaspersky Internet Security

References · 9

• 🔥 http://exploit-db.com/exploits/10484 · Exploit
• 🔥 https://exploit-db.com/exploits/10484 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4452 · Security Note
• http://secunia.com/advisories/37398 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3573 · Vendor Advisory
• http://secunia.com/advisories/37730 · Vendor Advisory
• http://securitytracker.com/id?1023367 · Note
• http://securitytracker.com/id?1023366 · Note
• http://securityfocus.com/archive/1/508508/100/0/threaded · Note