Security News Multiple vulnerabilities found in Kaspersky Lab's Anti-Virus for Linux File Server

Exterminator

Community Manager
Thread author
Verified
Staff Member
Well-known
Oct 23, 2012
12,527
People expect their anti-virus to protect them from malware and exploits but sometimes, even these products have their own vulnerabilities. Leandro Barragan and Maximiliano Vidal, researchers at network security firm Core Security, have found a number of possible exploits in the Web Management Console for Kaspersky's Anti-virus for Linux File Servers.

These vulnerabilities would enable hackers to carry out potentially devastating attacks on enterprises that use the program, such as enabling a remote attack to gain root access to the system. The vector for doing so is Cross-Site Request Forgery as Core Security claims the program has no Anti-CSRF of any form in the interface. This would allow attackers to gain low-level privileges, which can then be elevated to root access.

Other vulnerabilities also found were reflected cross-site scripting and a path traversal.

Barragan and Vidal found these exploits back in April and promptly contacted Kaspersky Lab. The company has since confirmed all the vulnerabilities reported and has been working in conjunction with Core Security to fix the issues. Patch 13738 which includes the fix was pushed out earlier this month on June 14 and can also be grabbed from Kaspersky's website.

Source: Core Security
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top