Filip Dragovic

توجد ثغرة أمنية تتعلق برفع الامتيازات المحلية في برنامج Bitdefender Total Security. يمكن لمهاجم يتمتع بامتيازات منخفضة الحصول على امتيازات عالية بسبب التحقق غير الكافي من صحة الارتباط الرمزي عندما يقوم ملف `bdservicehost.exe` بحذف الملفات من دليل يمكن للمستخدم الكتابة فيه، وتحديدًا `C:ProgramDataAtcFeedback`. وهذا يسمح بحذف الملفات بشكل تعسفي. ويرتبط هذا الخلل بعملية نسخ الملفات أثناء أحداث الشبكة، بالإضافة إلى تجاوز برنامج تشغيل التصفية عن طريق حقن مكتبة DLL، مما يؤدي إلى نسخ الملفات بشكل تعسفي وتنفيذ التعليمات البرمجية بامتيازات مستخدم مرتفعة.

قد تسمح ثغرة أمنية تتعلق بأذونات التسجيل في أداة التحديث الخاصة بـ Intercept X for Windows لمستخدم محلي بالحصول على امتيازات بمستوى SYSTEM أثناء عملية تحديث المنتج.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: Microsoft PC Manager (الإصدارات المتأثرة غير محددة) الوصف: تتعلق المشكلة بوجود ثغرة في التحكم في الوصول في برنامج Microsoft PC Manager، مما يسمح لمهاجم مخول برفع مستوى امتيازاته محليًّا. وقد يؤدي ذلك إلى ثغرة أمنية تتمثل في رفع مستوى الامتيازات محليًّا. التوصيات: لا توجد في الوقت الحالي أي معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

تتعلق المشكلة بهجوم حقن كيان خارجي XML (XXE) عند معالجة بيانات XML. يمكن لمهاجم بعيد معتمد استغلال هذه الثغرة لتنفيذ أوامر تعسفية.

The issue is related to errors in processing input data in the Core component of Oracle VM VirtualBox. This can be exploited by an attacker to elevate privileges or execute arbitrary code by manipulating log files. The vulnerability applies to Windows hosts only and can result in the takeover of Oracle VM VirtualBox. Successful attacks can compromise the confidentiality, integrity, and availability of the system.

The issue is related to the Avira Spotlight Service in Avira Prime, which incorrectly handles symbolic links before accessing a file. This can be exploited by a local attacker to escalate privileges and execute arbitrary code in the context of SYSTEM. The attacker must first obtain the ability to execute low-privileged code on the target system. The vulnerability allows an attacker to create a symbolic link and abuse the service to delete a file, leading to privilege escalation.

This issue allows local attackers to escalate privileges on affected installations of G Data Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the GDBackupSvc service, where an attacker can create a symbolic link to abuse the service and create a file with a permissive DACL, potentially leading to privilege escalation and execution of arbitrary code in the context of SYSTEM.

This issue allows local attackers to escalate privileges on affected installations. The flaw exists within the Forensic Recorder service, where an attacker can create a symbolic link to abuse the service and overwrite arbitrary files, potentially executing arbitrary code in the context of SYSTEM. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue.

The issue is related to insufficient access restrictions in Microsoft Visual Studio, which can be exploited to elevate privileges.

The issue is related to incorrect cleanup or release of resources in the .NET Framework, which can be exploited to cause a denial of service. This allows an attacker to affect the system.

The issue is related to synchronization errors when using a shared resource in the Malicious Software Removal Tool (MSRT), which can allow an attacker to elevate their privileges.

The issue is related to insufficient access control in the Microsoft Windows System Monitor (Sysmon) service, which can allow an attacker to elevate their privileges. The vulnerability can be exploited to achieve arbitrary file deletion and limited arbitrary file write, potentially leading to code execution as NT AuthoritySystem.

A vulnerability in the client update process of Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established. This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process, such as the `vpndownloader.exe` process, which creates a directory in `c:windowstemp` with default permissions. A successful exploit could allow the attacker to execute code with SYSTEM privileges, potentially allowing for arbitrary file deletion as the NT AuthoritySYSTEM account.

The issue is related to the Software Updater functionality of Avira Security, which allows an attacker with write access to the filesystem to escalate their privileges in certain scenarios. This is due to the possibility of downloading arbitrary files.

The issue is related to errors in privilege management within the Windows Backup Service, allowing an attacker to elevate their privileges to the level of SYSTEM. This can potentially impact the system, enabling malicious activities. There have been public proofs of concept (PoCs) released, demonstrating the ability to delete any file and launch a shell with elevated privileges.