cnvd - cnvd-2020-35474

CNVD-2020-35474

Vulnerability from cnvd - Published: 2020-06-30

Title

Avira Operations Avira Software Updater提权漏洞

Description

Avira Operations Avira Software Updater是Avira Operations公司的一款用于Avira产品的软件升级管理工具。 Avira Operations Avira Software Updater 2.0.6.27476之前版本中存在提权漏洞，该漏洞源于程序未能正确处理文件的硬链接。本地攻击者可利用该漏洞控制任意文件。

Severity

中

Patch Name

Avira Operations Avira Software Updater提权漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://support.avira.com/hc/en-us/articles/360000142857-Avira-Software-Updater

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-12463

Impacted products

Name
Avira Operations Avira Operations Avira Software Updater <2.0.6.27476

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-12463"
    }
  },
  "description": "Avira Operations Avira Software Updater\u662fAvira Operations\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8eAvira\u4ea7\u54c1\u7684\u8f6f\u4ef6\u5347\u7ea7\u7ba1\u7406\u5de5\u5177\u3002\n\nAvira Operations Avira Software Updater 2.0.6.27476\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u63d0\u6743\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5904\u7406\u6587\u4ef6\u7684\u786c\u94fe\u63a5\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63a7\u5236\u4efb\u610f\u6587\u4ef6\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://support.avira.com/hc/en-us/articles/360000142857-Avira-Software-Updater",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-35474",
  "openTime": "2020-06-30",
  "patchDescription": "Avira Operations Avira Software Updater\u662fAvira Operations\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8eAvira\u4ea7\u54c1\u7684\u8f6f\u4ef6\u5347\u7ea7\u7ba1\u7406\u5de5\u5177\u3002\r\n\r\nAvira Operations Avira Software Updater 2.0.6.27476\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u63d0\u6743\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5904\u7406\u6587\u4ef6\u7684\u786c\u94fe\u63a5\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63a7\u5236\u4efb\u610f\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Avira Operations Avira Software Updater\u63d0\u6743\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Avira Operations Avira Operations Avira Software Updater \u003c2.0.6.27476"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-12463",
  "serverity": "\u4e2d",
  "submitTime": "2020-05-06",
  "title": "Avira Operations Avira Software Updater\u63d0\u6743\u6f0f\u6d1e"
}

CVE-2020-12463 (GCVE-0-2020-12463)

Vulnerability from cvelistv5 – Published: 2020-05-05 21:18 – Updated: 2024-08-04 11:56

Summary

An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users to obtain take control of arbitrary files.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

https://support.avira.com/hc/en-us/articles/36000…

x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:56:52.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.avira.com/hc/en-us/articles/360000142857-Avira-Software-Updater"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users to obtain take control of arbitrary files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-05T21:18:38",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.avira.com/hc/en-us/articles/360000142857-Avira-Software-Updater"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-12463",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users to obtain take control of arbitrary files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.avira.com/hc/en-us/articles/360000142857-Avira-Software-Updater",
              "refsource": "CONFIRM",
              "url": "https://support.avira.com/hc/en-us/articles/360000142857-Avira-Software-Updater"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-12463",
    "datePublished": "2020-05-05T21:18:38",
    "dateReserved": "2020-04-29T00:00:00",
    "dateUpdated": "2024-08-04T11:56:52.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-35474

CVE-2020-12463 (GCVE-0-2020-12463)

Tags

Sightings

Nomenclature