FKIE_CVE-2009-4452

Vulnerability from fkie_nvd - Published: 2009-12-29 20:41 - Updated: 2026-06-16 23:13
Severity
Summary
Kaspersky Anti-Virus 5.0 (5.0.712); Antivirus Personal 5.0.x; Anti-Virus 6.0 (6.0.3.837), 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); and Internet Security 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); use weak permissions (Everyone:Full Control) for the BASES directory, which allows local users to gain SYSTEM privileges by replacing an executable or DLL with a Trojan horse.
References
cve@mitre.orghttp://secunia.com/advisories/37398Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/37730Vendor Advisory
cve@mitre.orghttp://www.exploit-db.com/exploits/10484Exploit
cve@mitre.orghttp://www.securityfocus.com/archive/1/508508/100/0/threaded
cve@mitre.orghttp://www.securitytracker.com/id?1023366
cve@mitre.orghttp://www.securitytracker.com/id?1023367
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/3573Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37398Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37730Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/10484Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/508508/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1023366
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1023367
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/3573Vendor Advisory
Impacted products
Vendor Product Version
kaspersky_lab kaspersky_anti-virus 5.0.712
kaspersky_lab kaspersky_anti-virus 6.0.3.837
kaspersky_lab kaspersky_anti-virus 6.0.3.837
kaspersky_lab kaspersky_anti-virus 7.0.1.325
kaspersky_lab kaspersky_anti-virus_2009 8.0.0.454
kaspersky_lab kaspersky_anti-virus_2010 9.0.0.463
kaspersky_lab kaspersky_anti-virus_personal 5.0
kaspersky_lab kaspersky_anti-virus_personal 5.0.227
kaspersky_lab kaspersky_anti-virus_personal 5.0.228
kaspersky_lab kaspersky_anti-virus_personal 5.0.325
kaspersky_lab kaspersky_internet_security 7.0.1.325
kaspersky_lab kaspersky_internet_security_2009 8.0.0.506
kaspersky_lab kaspersky_internet_security_2010 9.0.0.463
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:5.0.712:*:windows_workstations:*:*:*:*:*",
              "matchCriteriaId": "1D6BB158-236E-4B5B-B32F-265484B88668",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:6.0.3.837:*:windows_file_servers:*:*:*:*:*",
              "matchCriteriaId": "FC269851-529F-4806-B873-1024F05EE1BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:6.0.3.837:*:windows_workstation:*:*:*:*:*",
              "matchCriteriaId": "897366CD-7C06-4124-A66A-9D499FFE0E09",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus:7.0.1.325:*:*:*:*:*:*:*",
              "matchCriteriaId": "A80BDC43-39DB-49C9-9F73-A97B42EAE74D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_2009:8.0.0.454:*:*:*:*:*:*:*",
              "matchCriteriaId": "6CE76B5D-5587-4ECE-8530-440BF4F453B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_2010:9.0.0.463:*:*:*:*:*:*:*",
              "matchCriteriaId": "46A667E4-8E75-4CFF-B30D-1D3D11200A44",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2BA07931-220A-4FCC-A83D-0C91563385DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0.227:*:*:*:*:*:*:*",
              "matchCriteriaId": "E101D150-B268-43AA-9876-469DF471DFC4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0.228:*:*:*:*:*:*:*",
              "matchCriteriaId": "22A10BAE-B162-4276-8B08-8E449D9B282D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_anti-virus_personal:5.0.325:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F3AAC32-1911-4955-B1B1-CF7B26BEA3F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_internet_security:7.0.1.325:*:*:*:*:*:*:*",
              "matchCriteriaId": "65942CAB-ED76-4FC6-81AF-E3AE56A58185",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_internet_security_2009:8.0.0.506:*:*:*:*:*:*:*",
              "matchCriteriaId": "03D166CB-4E20-4A58-BE03-EB342B477027",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kaspersky_lab:kaspersky_internet_security_2010:9.0.0.463:*:*:*:*:*:*:*",
              "matchCriteriaId": "E125CB4B-DA1B-4D37-B1C7-9F7025716BA7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kaspersky Anti-Virus 5.0 (5.0.712); Antivirus Personal 5.0.x; Anti-Virus 6.0 (6.0.3.837), 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); and Internet Security 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); use weak permissions (Everyone:Full Control) for the BASES directory, which allows local users to gain SYSTEM privileges by replacing an executable or DLL with a Trojan horse."
    },
    {
      "lang": "es",
      "value": "Kaspersky Anti-Virus v5.0 (v5.0.712); Antivirus Personal v5.0.x; Anti-Virus v6.0 (v6.0.3.837), v7 (v7.0.1.325), 2009 (v8.0.0.x), and 2010 (v9.0.0.463); y Internet Security v7 (v7.0.1.325), 2009 (v8.0.0.x), and 2010 (v9.0.0.463); usan permisos d\u00e9biles (Todo el mundo: Control Total) en el directorio BASES, lo que permite a usuarios locales obtener privilegios de SYSTEM sustituyendo un ejecutable o DLL con un caballo de troya."
    }
  ],
  "id": "CVE-2009-4452",
  "lastModified": "2026-06-16T23:13:41.717",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.8,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-12-29T20:41:20.577",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/37398"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/37730"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/10484"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/508508/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1023366"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1023367"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/3573"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/37398"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/37730"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/10484"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/508508/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1023366"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1023367"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/3573"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.