[NT] NOD32 Local Privilege Escalation

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



NOD32 Local Privilege Escalation
------------------------------------------------------------------------


SUMMARY

" <http://www.eset.com/> NOD32 Antivirus System provides well balanced,
state-of-the-art protection against threats endangering your PC and
enterprise systems running various platforms from Microsoft Windows 95 /
98 / ME / NT / 2000 / 2003 / XP, through a number of UNIX/Linux, Novell,
MS DOS operating systems to Microsoft Exchange Server, Lotus Domino and
other mail servers."

Lack of proper permission validation allows local users to gain
administrator privileges in NOD32.

DETAILS

Vulnerable Systems:
* NOD32 Version 2.51.25 and prior

Immune Systems:
* NOD32 Version 2.51.26

Like many other AntiVirus products, NOD32 allows users to place files
under quarantine.
A non privileged user can restore a file that exists in quarantine, and
place it on a privileged directory that the user does not have write
permission for.

Disclosure Timeline:
Vender reported: Mar 24, 2006
Patch release: Apr 4, 2006 (Version 2.51.26)


ADDITIONAL INFORMATION

The information has been provided by <mailto:visitbipin@xxxxxxxxxxx>
Bipin Gautam.
The original article can be found at:
<http://bipin.securityhead.com/NOD32.zip>
http://bipin.securityhead.com/NOD32.zip



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages