PT-2019-12281 · Avira · Avira Free Security Suite

Silton Santos · Published 2019-08-29 · Updated 2020-08-24 · CVE-2019-11396

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avira Free Security Suite version 10

Description An issue in Avira Free Security Suite allows unprivileged users to obtain SYSTEM privileges due to permissive access rights on the SoftwareUpdater folder. This can be exploited by creating pseudo-symbolic links to arbitrary files, which can be used to achieve arbitrary file creation when an update occurs. The privileged service sets access rights, offering write access to the Everyone group in any directory.

Recommendations For Avira Free Security Suite version 10, consider restricting access to the SoftwareUpdater folder and its configuration files to prevent unprivileged users from replacing files with pseudo-symbolic links until a fix is available. As a temporary workaround, restrict write access to the Everyone group in any directory to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2019-11396

Affected Products

Avira Free Security Suite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-11396 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11396 · Vendor Advisory
• http://packetstormsecurity.com/files/153868/Avira-Free-Security-Suite-2019-Software-Updater-2.0.6.13175-Improper-Access-Control.html · Note
• https://medium.com/sidechannel-br/vulnerabilidade-no-avira-security-suite-pode-levar-%C3%A0-escala%C3%A7%C3%A3o-de-privil%C3%A9gios-no-windows-71964236c077 · Note
• https://seclists.org/fulldisclosure/2019/Aug/1 · Note