CVE-2007-4649 MicroWorld eScan Virus Control 9.0.722.1, Anti-Virus 9.0.722.1, and Internet Security 9.0.722.1 use weak permissions (Everyone:Full Control) for their installation directory trees, which allows local....
HighCVSS 7.2
EPSS 0.89%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
MicroWorld eScan Virus Control 9.0.722.1, Anti-Virus 9.0.722.1, and Internet Security 9.0.722.1 use weak permissions (Everyone:Full Control) for their installation directory trees, which allows local users to gain privileges by replacing application files, as demonstrated by traysser.exe.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microworld technologies escan anti-virus | = 9.0.722.1 | No fix listed |
| microworld technologies escan internet security | = 9.0.722.1 | No fix listed |
| microworld technologies escan virus control | = 9.0.722.1 | No fix listed |
References
- 20070829 Multiple eScan products insecure file permissions exploit mailing-list
- 26581 third-party-advisory vendor-advisory
- 3085 third-party-advisory
- 25493 exploit vdb-entry
- escan-directory-insecure-permissions(36367) vdb-entry