PT-2022-20743 · Quick Heal · Quick Heal Total Security

Sandeep Kumar Singh · Published 2022-05-23 · Updated 2023-08-08 · CVE-2022-31466

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quick Heal Total Security versions prior to 12.1.1.27

Description A Time of Check - Time of Use (TOCTOU) issue allows a local attacker to achieve privilege escalation, potentially leading to deletion of system files. This is achieved by exploiting the time between detecting a file as malicious and when the action of quarantining or cleaning is performed, and using the time to replace the malicious file with a symlink. The vulnerability may follow a symlink that was created after a malware check.

Recommendations For versions prior to 12.1.1.27, update to version 12.1.1.27 or later to resolve the issue. As a temporary workaround, consider restricting access to system files to minimize the risk of exploitation. Avoid using the symlink feature in the affected software until the issue is resolved.

Fix

Link Following

Time Of Check To Time Of Use

Weakness Enumeration

CWE-59

CWE-367

Related Identifiers

CVE-2022-31466

Affected Products

Quick Heal Total Security

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-31466 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31466 · Vendor Advisory
• https://softwaresec001.wordpress.com/2022/05/13/privilege-escalation-vulnerability-in-quick-heal-total-security · Note
• https://t.me/cibsecurity/43185 · Telegram Post
• https://t.me/cvenotify/30592 · Telegram Post