Vulnerability in Kaspersky Lab Anti-Virus
CVE-2009-4452
Kaspersky Anti-Virus 5.0 (5.0.712); Antivirus Personal 5.0.x; Anti-Virus 6.0 (6.0.3.837), 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); and Internet Security 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); use weak permissions (Everyone:Full Control) for the BASES directory, which allows local users to gain SYSTEM privileges by replacing an executable or DLL with a Trojan horse.
EPSS: 0.008 (53.6th percentile) — read the EPSS interpretation.
Affected products
- Kaspersky_lab Kaspersky_anti-virus — versions 5.0.712, 6.0.3.837, 7.0.1.325
- Kaspersky_lab Kaspersky_anti-virus_2009 — versions 8.0.0.454
- Kaspersky_lab Kaspersky_anti-virus_2010 — versions 9.0.0.463
- Kaspersky_lab Kaspersky_anti-virus_personal — versions 5.0, 5.0.227, 5.0.228
- Kaspersky_lab Kaspersky_internet_security — versions 7.0.1.325
- Kaspersky_lab Kaspersky_internet_security_2009 — versions 8.0.0.506
- Kaspersky_lab Kaspersky_internet_security_2010 — versions 9.0.0.463
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (Exploit, exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)