CVE-2013-3154 The signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 relies on an incorrect pathname, which allows local users to gain privileges via a Trojan horse...
MediumCVSS 6.9
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 relies on an incorrect pathname, which allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory, aka "Microsoft Windows 7 Defender Improper Pathname Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Windows Defender | All versions | No fix listed |
| Microsoft windows 7 | All versions | No fix listed |
| Microsoft windows server 2008 | All versions | No fix listed |
References
- blogs.technet.com vendor-advisory
- TA13-190A third-party-advisory us-government-resource
- MS13-058 vendor-advisory
- oval:org.mitre.oval:def:17253 signature vdb-entry