Kaspersky Anti-Spam < 3.0.0 [0278] File Permission Weakness Local Privilege Escalation

low Nessus Network Monitor Plugin ID 4154

Synopsis

The remote host is vulnerable to a local flaw due to the way that it creates local file permissions.

Description

The remote host is running the Kaspersky Anti-spam server. This version of Kaspersky is vulnerable to a local flaw. Specifically, it is alleged that the application creates local files with permissions that would allow a local attacker the ability to either gain access to confidential data or subvert the integrity of the application. The details of the flaw are currently unknown; however, the vendor has acknowledged the flaw. An attacker exploiting these flaws would need local access to the machine. Successful exploitation would result in the attacker gaining access to confidential data or processes.

Solution

Upgrade to version 3.0.0 [0278] or higher.

Plugin Details

Severity: Low

ID: 4154

Family: CGI

Published: 8/3/2007

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: Low

Base Score: 1.2

Temporal Score: 0.9

Vector: CVSS2#AV:L/AC:H/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Low

Base Score: 2.9

Temporal Score: 2.6

Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:kaspersky_lab:kaspersky_anti-spam

Reference Information

CVE: CVE-2007-4206

BID: 25189

Detections

Analytics