Description
The VisNetic AntiVirus Plug-in (DKAVUpSch.exe) for Mail Server 4.6.0.4, 4.6.1.1, and possibly other versions before 4.6.1.2, does not drop privileges before executing other programs, which allows local users to gain privileges.
References
- 1015670 vdb-entry
- http://secunia.com/secunia_research/2005-65/advisory/
- 16583 third-party-advisory
- ADV-2006-0701 vdb-entry
- 16788 vdb-entry
- visnetic-av-plugin-privilege-elevation(24928) vdb-entry
- 20060223 Secunia Research: Visnetic AntiVirus Plug-in for MailServerPrivilege Escalation mailing-list