Description
F-Secure Anti-Virus for Windows Servers 7.0 64-bit edition allows local users to bypass virus scanning by using the system32 directory to store a crafted (1) archive or (2) packed executable. NOTE: in many environments, this does not cross privilege boundaries because any process able to write to system32 could also shut off F-Secure Anti-Virus.
References
- fsecure-executables-security-bypass(36833) vdb-entry
- http://www.f-secure.com/security/fsc-2007-6.shtml
- 25824 vdb-entry
- 1018745 vdb-entry
- 41377 vdb-entry
- ADV-2007-3277 vdb-entry
- 26948 third-party-advisory