PT-2021-20801 · Panda Security · Panda Security Free Antivirus

Izobashi + 1 · Published 2021-11-29 · Updated 2022-01-20 · CVE-2021-34998

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Panda Security Free Antivirus version 20.2.0.0

Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the use of named pipes, where an untrusted process can impersonate the client of a pipe. This can be leveraged to escalate privileges and execute arbitrary code in the context of SYSTEM.

Recommendations: For Panda Security Free Antivirus version 20.2.0.0, consider restricting access to named pipes to prevent untrusted processes from impersonating the client of a pipe until a patch is available. As a temporary workaround, limiting the ability of low-privileged code to execute on the target system can also help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-250

CWE-269

Related Identifiers

CVE-2021-34998

ZDI-21-1336

Affected Products

Panda Security Free Antivirus

References · 5

• https://pandasecurity.com/en/support/card?id=100077 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34998 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-1336 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34998 · Security Note
• https://t.me/cvenotify/25450 · Telegram Post