Lucene search

K
cve[email protected]CVE-2006-1221
HistoryMar 14, 2006 - 11:02 a.m.

CVE-2006-1221

2006-03-1411:02:00
web.nvd.nist.gov
19
cve
2006
vulnerability
truevector
vsmon.exe
zone labs
zonealarm
integrity
dll
local users
path
permissions

6.8 Medium

AI Score

Confidence

High

6.2 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:H/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

9.6%

Untrusted search path vulnerability in the TrueVector service (VSMON.exe) in Zone Labs ZoneAlarm 6.x and Integrity does not search ZoneAlarm’s own folders before other folders that are specified in a user’s PATH, which might allow local users to execute code as SYSTEM by placing malicious DLLs into a folder that has insecure permissions, but is searched before ZoneAlarm’s folder. NOTE: since this issue is dependent on the existence of a vulnerability in a separate product (weak permissions of executables or libraries, or the execution of malicious code), perhaps it should not be included in CVE.

Affected configurations

NVD
Node
zonelabszonealarm_security_suiteMatch6.1.744.000

6.8 Medium

AI Score

Confidence

High

6.2 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:H/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

9.6%

Related for CVE-2006-1221