bugtraq - CVE-2014-3450 - Privilege Escalation in Panda Security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <537B8312.5000006@portcullis-security.com>
Date: Tue, 20 May 2014 17:30:10 +0100
From: Portcullis Advisories <advisories@...tcullis-security.com>
To: bugtraq@...urityfocus.com, moderators@...db.org,
  fulldisclosure@...lists.org, vuln@...unia.com
Subject: CVE-2014-3450 - Privilege Escalation in Panda Security

Vulnerability title: Privilege Escalation in Panda Security
CVE: CVE-2014-3450
Vendor: Panda
Product: Security
Affected version: See below
Fixed version: See below
Reported by: Kyriakos Economou

Details:

All users of the following (and possibly earlier) versions of Panda
security products for Windows are vulnerable to a local privilege
escalation which allows a local attacker to elevate privileges from any
account type and execute code as SYSTEM, thus obtaining full access over
the compromised host.

Panda Gold Protection v7.01.01
Panda Global Protection 2014 v7.01.01
Panda Internet Security 2014 v19.01.01
Panda AV Pro 2014 v13.01.01

Hotfixes for these products have been released.

Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3450/

Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information.