Lucene search

MitreCVE-2009-4215

HistoryDec 07, 2009 - 5:30 p.m.

CVE-2009-4215

2009-12-0717:30:00

CWE-264

mitre

web.nvd.nist.gov

cve-2009-4215

panda

global protection

internet security

antivirus pro

weak permissions

local privilege escalation

trojan horse

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.6

Confidence

Low

EPSS

Percentile

5.1%

JSON

Panda Global Protection 2010, Internet Security 2010, and Antivirus Pro 2010 use weak permissions (Everyone: Full Control) for the product files, which allows local users to gain privileges by replacing executables with Trojan horse programs.

Affected configurations

Nvd

Node

microsoftwindows_7

microsoftwindows_vista32_bit

microsoftwindows_vista64-bit

microsoftwindows_xp32-bit

AND

pandasecuritypanda_antivirusMatch2010pro

pandasecuritypanda_global_protectionMatch2010

pandasecuritypanda_internet_securityMatch2010pro

VendorProductVersionCPE
microsoftwindows_7*cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*
microsoftwindows_vista*cpe:2.3:o:microsoft:windows_vista:*:*:32_bit:*:*:*:*:*
microsoftwindows_vista*cpe:2.3:o:microsoft:windows_vista:*:*:64-bit:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:*:32-bit:*:*:*:*:*
pandasecuritypanda_antivirus2010cpe:2.3:a:pandasecurity:panda_antivirus:2010:*:pro:*:*:*:*:*
pandasecuritypanda_global_protection2010cpe:2.3:a:pandasecurity:panda_global_protection:2010:*:*:*:*:*:*:*
pandasecuritypanda_internet_security2010cpe:2.3:a:pandasecurity:panda_internet_security:2010:*:pro:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows_7	*	cpe:2.3:o:microsoft:windows_7::::::::
microsoft	windows_vista	*	cpe:2.3:o:microsoft:windows_vista:::32_bit:::::*
microsoft	windows_vista	*	cpe:2.3:o:microsoft:windows_vista:::64-bit:::::*
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp:::32-bit:::::*
pandasecurity	panda_antivirus	2010	cpe:2.3:a:pandasecurity:panda_antivirus:2010::pro:::::
pandasecurity	panda_global_protection	2010	cpe:2.3:a:pandasecurity:panda_global_protection:2010:::::::*
pandasecurity	panda_internet_security	2010	cpe:2.3:a:pandasecurity:panda_internet_security:2010::pro:::::

References

secunia.com/advisories/37373

www.pandasecurity.com/homeusers/support/card?id=80164&idIdioma=2

www.securityfocus.com/archive/1/507811/100/0/threaded

www.securitytracker.com/id?1023121

www.vupen.com/english/advisories/2009/3126

exchange.xforce.ibmcloud.com/vulnerabilities/54268

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.6

Confidence

Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2009-4215