Description
The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). By abusing the quarantine read and write operations, it is possible to elevate the privileges to root.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://seclists.org/fulldisclosure/2017/Jun/33 ↗
- http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html ↗
- http://www.securityfocus.com/bid/99330 ↗
- http://www.securitytracker.com/id/1038798 ↗
- https://www.exploit-db.com/exploits/42269/ ↗
- https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities ↗