Lucene search

[email protected]CVE-2007-4649

HistoryAug 31, 2007 - 11:17 p.m.

CVE-2007-4649

2007-08-3123:17:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2007-4649

escan

virus control

anti-virus

internet security

weak permissions

vulnerability

local users

privileges

application files

traysser.exe

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

0.4%

JSON

MicroWorld eScan Virus Control 9.0.722.1, Anti-Virus 9.0.722.1, and Internet Security 9.0.722.1 use weak permissions (Everyone:Full Control) for their installation directory trees, which allows local users to gain privileges by replacing application files, as demonstrated by traysser.exe.

Affected configurations

NVD

Node

microworld_technologiesescan_anti-virusMatch9.0.722.1

microworld_technologiesescan_internet_securityMatch9.0.722.1

microworld_technologiesescan_virus_controlMatch9.0.722.1

CPENameOperatorVersion
microworld_technologies:escan_anti-virusmicroworld technologies escan anti-viruseq9.0.722.1
microworld_technologies:escan_internet_securitymicroworld technologies escan internet securityeq9.0.722.1
microworld_technologies:escan_virus_controlmicroworld technologies escan virus controleq9.0.722.1

CPE	Name	Operator	Version
microworld_technologies:escan_anti-virus	microworld technologies escan anti-virus	eq	9.0.722.1
microworld_technologies:escan_internet_security	microworld technologies escan internet security	eq	9.0.722.1
microworld_technologies:escan_virus_control	microworld technologies escan virus control	eq	9.0.722.1

References

lists.grok.org.uk/pipermail/full-disclosure/2007-August/065509.html

secunia.com/advisories/26581

securityreason.com/securityalert/3085

www.securityfocus.com/bid/25493

exchange.xforce.ibmcloud.com/vulnerabilities/36367

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

0.4%

JSON

Related for CVE-2007-4649

cvelist1 prion1 nvd1