Description
Grisoft AVG Free 7.1, and other versions including 7.0.308, sets Everyone/Full Control permissions for certain update files including (1) upd_vers.cfg, (2) incavi.avm, and (3) unspecified drivers, which might allow local users to gain privileges.
References
- 16952 vdb-entry
- 20060303 AVG 7 granting Everyone Full Control to updated files... even its drivers mailing-list
- 19118 third-party-advisory
- 1015728 vdb-entry
- avg-update-gain-privilieges(25139) vdb-entry
- ADV-2006-0845 vdb-entry
- http://www.dslreports.com/forum/remark%2C15601404